Skip to content

CVE record · 2 sources

CVE-2026-107186

CVSS 8.6

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule.

Vendor: Rapid7
Product: InsightVM / Nexpose / Metasploit
CVSS: 8.6
EPSS: 0.004 (p32)
Exposure class: Network management

Coverage

2

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

25

Research Rapid7 12d ago

Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)

Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus . A legacy API endpoint could be exploited to bypass…

CVSS 8.6 CVE-2026-107186 CVE-2026-107187 CVE-2026-107188 Rapid7
10

CVE NVD 12d ago

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule.

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

CVSS 8.6 CVE-2026-107186