Apache OFBiz: 46 CVEs incl. pre-auth RCE and auth bypass fixed in 24.09.08

Severity: critical · Patch status: patched · Since 2026-11-04 · CVE-2026-100168, CVE-2026-100228, CVE-2026-105325, CVE-2026-105330, CVE-2026-105461, CVE-2026-109129, CVE-2026-109837, CVE-2026-109856, CVE-2026-109928, CVE-2026-114229, CVE-2026-114233, CVE-2026-114235, CVE-2026-114271, CVE-2026-114272, CVE-2026-114277, CVE-2026-66903, CVE-2026-68524, CVE-2026-71901, CVE-2026-73577, CVE-2026-73578, CVE-2026-73580, CVE-2026-74841, CVE-2026-76150, CVE-2026-76152, CVE-2026-81734, CVE-2026-81744, CVE-2026-81808, CVE-2026-81815, CVE-2026-81816, CVE-2026-81828, CVE-2026-82894, CVE-2026-82902, CVE-2026-82904, CVE-2026-82907, CVE-2026-82910, CVE-2026-82912, CVE-2026-82916, CVE-2026-82960, CVE-2026-83538, CVE-2026-83542, CVE-2026-84183, CVE-2026-84728, CVE-2026-85627, CVE-2026-92887, CVE-2026-97355, CVE-2026-97356

On 2026-11-04 the Apache OFBiz maintainer announced 46 CVEs affecting every release before 24.09.08, all addressed in 24.09.08. The announcement labels CVE-2026-68524 a pre-authentication remote code execution flaw, reached through an attacker-supplied screen definition, and describes CVE-2026-83542 (injection through the login-page widget) as unauthenticated RCE. CVE-2026-73578 is an unauthenticated saved-view authorization bypass that the post says has RCE impact; its exact preconditions are not stated. Several other RCE-class issues need an account: CVE-2026-82960 (a widget expression bypass of the Groovy sandbox), CVE-2026-84183 (RCE from a VIEW-only Content Manager role) and CVE-2026-85627 (authenticated code execution). The rest include a hard-coded JWT key that grants unauthenticated admin access (CVE-2026-105330), a password-reset flaw that enables full account takeover (CVE-2026-109928), a hard-coded credential in AdminServer that enables unauthenticated denial of service (CVE-2026-97355), SQL injection, XXE, SSRF, and many missing-authorization and IDOR flaws across Order, Catalog, Content, Payment and HR. The post gives no CVSS and marks no CVE as exploited. None of the 46 IDs appears in the CISA KEV feed (catalog 2026.11.03), and NVD had no record for the IDs sampled.

What to do

Upgrade Apache OFBiz to 24.09.08 immediately
Until upgraded, treat any low-privilege or view-only account as able to reach authenticated RCE (CVE-2026-82960, CVE-2026-84183, CVE-2026-85627)
If multitenant mode is used, review exposure to unauthenticated tenant DoS (CVE-2026-74841)
Audit for signs of exploitation of pre-auth RCE (CVE-2026-68524, CVE-2026-83542) and the JWT / hard-coded-key access paths (CVE-2026-105330)
Restrict external access to OFBiz instances and enforce authentication on REST APIs (CVE-2026-92887 is an auth bypass where the auth attribute is omitted)
Review account and authorization configurations for abuse of view-only roles

Fixed versions

24.09.08

Sources

Apache OFBiz: CVE Announcements (seclists.org)

All live incidents on Threat Watch

Threat Watch– active

All incidents

More on Threat Watch

More Apache Software Foundation incidents

Apache MINA 3.0 JavaNativeMessageDecoder unsafe deserialization enables RCE (CVE-2026-118636) Critical · Patch now
Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.) Critical · Patch now · Closed
Apache PLC4X OPC UA: signature bypass and silent downgrade enable MITM credential theft (CVE-2026-102508) Critical · Patch now · Closed

Browse

Helix Cyber

Is your stack exposed? Get it tested.

The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.

Get a pentest How it works

Agent Virtualization

Enterprise Coding Agents

Private AI Platform

Digital Sovereignty

Follow the Sun

The Speed Advantage

Financial Services

GPU Cloud & Neoclouds

Public Sector & Defence

More on Threat Watch

More Apache Software Foundation incidents

Browse

Is your stack exposed? Get it tested.