Apache OFBiz 24.09.08 Fixes 46 Flaws, Led by Pre-Auth Remote Code Execution CVE-2026-68524 — Every Earlier Version Is Affected
Apache OFBiz 24.09.08 fixes 46 vulnerabilities, including the unauthenticated code-injection flaw CVE-2026-68524 and several other no-login bugs, and every earlier release is affected.
The Apache OFBiz project has fixed 46 security vulnerabilities in one release. The most serious is CVE-2026-68524, which lets an unauthenticated attacker run code on the server. Every OFBiz version before 24.09.08 is affected. Because OFBiz has a long history of pre-authentication bugs being exploited soon after disclosure, administrators should treat this release as urgent.
What Happened
On 4 November 2026 the Apache OFBiz maintainers published CVE announcements on the oss-security mailing list covering the 24.09.08 release. The announcement says only that the batch includes "some critical issues". It does not give CVSS scores or credit researchers, and the NVD has not finished scoring the flaws.
OFBiz is an open-source Java ERP and e-commerce suite. It covers accounting, order management, catalogues, HR, manufacturing and storefronts, so an exposed instance usually sits next to customer, payment and employee data.
Technical Details
According to the CVE description, CVE-2026-68524 abuses OFBiz's temporary-file handling. An unauthenticated attacker can reach an open file descriptor and inject a file: URI, which makes OFBiz load an attacker-controlled Screen definition. Screen definitions are XML files that OFBiz renders server-side, and they can call scripts and services. Controlling one means running code. It is classed as CWE-94, code injection.
It is not the only bug in the batch that needs no login. The announcement also lists:
- CVE-2026-83542 – unauthenticated remote code execution through widget injection on the login page.
- CVE-2026-73578 – a saved-view authorisation bypass with remote code execution impact, without authentication.
- CVE-2026-105330 – a hard-coded cryptographic key in JWT authentication that allows admin access without logging in.
- CVE-2026-109928 – a flawed authentication algorithm in password reset that allows full account takeover.
- CVE-2026-82907 –
externalLoginKeyaccepted before authentication, reusable and not bound to a session. - CVE-2026-92887 – REST API authentication skipped by default when the auth attribute is omitted.
- CVE-2026-73577 – a path-suffix trick that bypasses view authorisation without authentication.
- CVE-2026-84728 – a cross-tenant authorisation bypass in mapped-domain login.
- Unauthenticated information disclosure in HR, catalogue and order helpers (CVE-2026-83538, CVE-2026-73580), and unauthenticated denial of service (CVE-2026-97355, CVE-2026-74841).
The release also fixes XML external entity injection (CVE-2026-81816), SQL injection in performFind on MySQL and MariaDB (CVE-2026-81815), server-side request forgery in SurveyWrapper (CVE-2026-81828), and unsandboxed Groovy compiled from a service parameter (CVE-2026-82912). The remaining CVEs are authenticated or authorisation issues.
Who Is Affected
- All Apache OFBiz versions before 24.09.08, according to the project.
- Instances with the web interface or REST API reachable from the internet are most at risk, since several of the flaws require no credentials.
- Products and internal tools built on OFBiz code, and multi-tenant deployments (two of the bugs target tenant isolation).
Exploitation Status
At the time of writing there are no public reports of in-the-wild exploitation, and CVE-2026-68524 is not in CISA's Known Exploited Vulnerabilities catalog. History suggests this may not last. In 2024, CISA added earlier OFBiz flaws, including CVE-2024-32113 and CVE-2024-38856, to its KEV catalog after attackers exploited them. Disclosing 46 fixes in one batch also makes it easy for attackers to diff the release and find the vulnerable code.
What To Do Now
- Upgrade every OFBiz instance to 24.09.08. This is the only fix the project has published.
- If you cannot upgrade immediately, take OFBiz off the internet. Put it behind a VPN or an allow-list at the reverse proxy, and restrict
/webtools,/apiand other admin paths to management networks. - Rotate secrets the bugs may have exposed: admin passwords, API tokens, JWT signing keys and any credentials in OFBiz configuration.
- Look for signs of earlier compromise: unexpected files in temporary directories, new or modified screen definitions, unusual password-reset activity, and child processes started by the Java process.
To check for shells or other unexpected child processes started by the OFBiz Java process:
# Shells or downloaders under the OFBiz JVM are a red flag
ps -ef --forest | grep -A3 "[o]fbiz"Why It Matters
Forty-six fixes in one release means many attack paths were found at once. For OFBiz users, the takeaway is simple: one CVE-2026-68524-style bug is enough to lose the server, and this release has several.
ERP systems are often forgotten. They are deployed once, customised heavily and then left alone because upgrades are painful. That is exactly why attackers keep coming back to OFBiz. If you run it, plan the upgrade now, before the first exploitation report forces you to.
