Apache OFBiz 24.09.08 Fixes 46 Vulnerabilities, Including Unauthenticated RCE Flaws

TL;DR

The Apache OFBiz project has disclosed 46 security flaws in its open-source ERP suite. The advisory says the list includes “some critical issues.” These Apache OFBiz vulnerabilities affect all versions before 24.09.08. Several allow remote code execution without logging in.

OFBiz 24.09.08 fixes pre-authentication RCE, authentication bypass, SQL injection, XXE and SSRF bugs. A hard-coded JWT key can also hand out admin access. Upgrade to OFBiz 24.09.08 now.

Notable CVEs

Why It Matters

OFBiz runs order, payment, catalog and HR processes, so a compromise exposes core business data. Attackers have targeted it before. CISA’s Known Exploited Vulnerabilities catalog already lists three OFBiz flaws from 2024: CVE-2024-32113, CVE-2024-38856 and CVE-2024-45195.

So far, no exploitation in the wild has been confirmed for this new batch. No public proof-of-concept has been reported either.

How the Attacks Work

Unauthenticated code execution

• CVE-2026-68524: pre-authentication RCE through “attacker-controlled screen definition loading.”
• CVE-2026-83542: unauthenticated RCE through login-page widget injection.
• CVE-2026-73578: an unauthenticated saved-view authorization bypass “with RCE impact.”

Authenticated code execution

Several more bugs need a login but still lead to code execution. For example, CVE-2026-82912 compiles “unsandboxed Groovy” from a service parameter. Similarly, CVE-2026-82960 uses widget expressions to escape the Groovy sandbox. CVE-2026-84183 even lets a Content Manager user with VIEW-only rights run code.

Authentication bypass

CVE-2026-105330 uses a hard-coded cryptographic key in JWT authentication. According to the advisory list, it “enables unauthenticated administrative access.” Meanwhile, CVE-2026-92887 bypasses REST API authentication when an operation omits its auth attribute. In addition, CVE-2026-109928 allows “full account takeover” through a flawed password reset.

Other flaw types

The remaining bugs include path traversal, SQL injection on MySQL and MariaDB, XXE, SSRF and unsandboxed Groovy execution. Many others let view-only users change orders, payments, refunds or financial account balances. Two flaws affect multitenant setups, including a cross-tenant login bypass, CVE-2026-84728.

Affected Versions

All Apache OFBiz versions prior to 24.09.08 are affected. The project has not published CVSS scores for each flaw yet.

Patch and Mitigation

• Upgrade to Apache OFBiz 24.09.08 from the official OFBiz download page.
• Keep OFBiz admin and webtools interfaces off the public internet.
• Review the full list of Apache OFBiz vulnerabilities on the OFBiz security page.

Given the project’s history with active attacks, admins should treat this update as urgent.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.