Apache OFBiz 24.09.08 Fixes 46 CVEs, Including Pre-Auth RCE and Authentication Bypasses: What to Patch and Rotate
MAG212 CYBER | Critical CVEs | November 6, 2026
The Apache OFBiz project has disclosed 46 CVEs in a single announcement, all affecting every release before 24.09.08. The advisory, posted to the oss-security mailing list on 4 November 2026, says the batch includes “some critical issues” and gives one fix: upgrade to Apache OFBiz 24.09.08. Several titles describe pre-authentication remote code execution and authentication bypass. OFBiz has been a repeated target of mass exploitation, so this batch needs prompt attention, even though no exploitation has been reported yet.
Key facts
| Item | Detail |
|---|---|
| Product | Apache OFBiz, the open-source ERP and e-commerce framework |
| CVEs | 46, announced together on 4 November 2026 |
| Affected | “All versions prior to 24.09.08” |
| Fix | Upgrade to Apache OFBiz 24.09.08 |
| Severity | Advisory says “some critical issues”; per-CVE ratings only in individual CVE records |
| Records published | 5 November 2026 (CVE.org) |
| Extra step | ./gradlew rotateSecretKeys for deployments affected by CVE-2026-105330 |
| Exploitation / KEV | None reported for any of the 46 as of 6 November 2026 |
What Apache announced
The announcement, titled “Apache OFBiz: CVE Announcements”, was sent by Jacopo Cappellato on 4 November 2026. It is short. It says that “multiple security vulnerabilities have been identified in Apache OFBiz, including some critical issues”, lists 46 CVE IDs with one-line titles, and advises users “to upgrade to Apache OFBiz 24.09.08, which addresses these vulnerabilities.” It has no per-CVE severity, no credits and no descriptions beyond the titles.
The OFBiz security page lists the same 46 IDs as fixed in 24.09.08, each linked to its fix in the apache/ofbiz-framework repository. Two fixes also touch the plugins repository: CVE-2026-92887 (ofbiz-plugins PR #408) and CVE-2026-114277 (ofbiz-plugins PR #454 plus framework PR #2383). The security page gives no titles, severities or credits.
Severity and credits live in the individual CVE records, which went public on 5 November. The records we checked use Apache’s text ratings (“important”, “moderate”) and carry no CNA CVSS score and no CISA enrichment.
All 46 CVEs, grouped by type
The titles below were extracted from the oss-security message and checked, where possible, against the published CVE records. The grouping is MAG212’s, based only on title wording. Apache did not group the CVEs, and a title alone does not tell you the exact preconditions. CVE-2026-97355 also causes denial of service but is listed once, under credentials.
| Group (MAG212) | CVE | Title as announced |
|---|---|---|
| Unauthenticated / pre-auth RCE | CVE-2026-68524 | Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading |
| Unauthenticated / pre-auth RCE | CVE-2026-83542 | Unauthenticated RCE via login-page widget injection |
| Unauthenticated / pre-auth RCE | CVE-2026-73578 | Unauthenticated saved-view authorization bypass with RCE impact |
| Authenticated code execution | CVE-2026-82960 | Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE |
| Authenticated code execution | CVE-2026-84183 | Content Manager VIEW-only RCE in updateLayout |
| Authenticated code execution | CVE-2026-85627 | Authenticated Code Execution Vulnerability |
| Authenticated code execution | CVE-2026-82912 | Unsandboxed Groovy compiled from a service parameter |
| Authenticated code execution | CVE-2026-82910 | renderLink compiles link parameters as FreeMarker source |
| Authenticated code execution | CVE-2026-82894 | Content renderer runs a service name stored on the row |
| Authenticated code execution | CVE-2026-71901 | Dispatch arbitrary internal services on SFA component |
| Authentication bypass / credentials | CVE-2026-105330 | Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access |
| Authentication bypass / credentials | CVE-2026-92887 | REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation |
| Authentication bypass / credentials | CVE-2026-109928 | Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover |
| Authentication bypass / credentials | CVE-2026-82907 | externalLoginKey honoured pre-auth, reusable and unbound |
| Authentication bypass / credentials | CVE-2026-97356 | Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass |
| Authentication bypass / credentials | CVE-2026-97355 | Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service |
| Authentication bypass / credentials | CVE-2026-84728 | Cross-tenant authorization bypass in mapped-domain login |
| Authentication bypass / credentials | CVE-2026-114277 | Janrain Engage Social Login Improperly Binds External Identities to Local Accounts |
| Unauthenticated view bypass / disclosure | CVE-2026-73577 | Unauthenticated path-suffix view authorization bypass |
| Unauthenticated view bypass / disclosure | CVE-2026-73580 | Unauthenticated HR organization and employee disclosure |
| Unauthenticated view bypass / disclosure | CVE-2026-83538 | Unauthenticated disclosure through HR, Catalog, and Order Manager helpers |
| SQL injection | CVE-2026-81815 | SQL injection – performFind ignore-case values, MySQL/MariaDB |
| XML external entity | CVE-2026-81816 | XML external entity injection (XXE) |
| SSRF / server-side fetch | CVE-2026-81828 | Server-side request forgery in SurveyWrapper |
| SSRF / server-side fetch | CVE-2026-82902 | Unfiltered server-side URL fetch in webtools viewdatafile |
| Path traversal / file write | CVE-2026-66903 | Authenticated Path Traversal in Catalog Image Management |
| Path traversal / file write | CVE-2026-76150 | Authenticated path traversal and missing authorization check in replaceImageToExistImage |
| Path traversal / file write | CVE-2026-76152 | Authenticated path traversal and missing authorization check in imageCrop and imageRotate services |
| Path traversal / file write | CVE-2026-82916 | webtools xmldsdump exports any entity to any path |
| Cross-site scripting | CVE-2026-114229 | Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session |
| Denial of service | CVE-2026-74841 | Denial of Service via unauthenticated userTenantId in multitenant mode |
| Denial of service | CVE-2026-82904 | Unbounded multi-form row count from a parameter name |
| Missing authorization / business logic | CVE-2026-81734 | Missing authorization – catalog quick-admin product writes |
| Missing authorization / business logic | CVE-2026-81744 | Authorization bypass – self-grant content OWNER |
| Missing authorization / business logic | CVE-2026-81808 | Missing authorization – search-result bulk catalog mutation |
| Missing authorization / business logic | CVE-2026-100168 | Missing Authorization vulnerability |
| Missing authorization / business logic | CVE-2026-100228 | Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation |
| Missing authorization / business logic | CVE-2026-105325 | Missing authorization in payment application services allows view-only users to modify payment allocations |
| Missing authorization / business logic | CVE-2026-105461 | Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities |
| Missing authorization / business logic | CVE-2026-109129 | Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification |
| Missing authorization / business logic | CVE-2026-109837 | Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association |
| Missing authorization / business logic | CVE-2026-109856 | Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation |
| Missing authorization / business logic | CVE-2026-114233 | Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders |
| Missing authorization / business logic | CVE-2026-114235 | Direct Request in Order Manager Enables Unauthorized Tracking Number Modification |
| Missing authorization / business logic | CVE-2026-114271 | Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification |
| Missing authorization / business logic | CVE-2026-114272 | Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure |
The largest group, 14 missing-authorization and business-logic flaws, matters more in an ERP than the label suggests. Several titles describe view-only users changing payment allocations, order prices, refund amounts or financial account balances.
The four CVE records with published detail
We retrieved four of the 46 records from CVE.org. All were published on 5 November 2026 and none has a CVSS score or a CISA enrichment container.
CVE-2026-105330: hard-coded JWT key (moderate)
A forged JWT signed with the factory-default security.token.key gives an unauthenticated network attacker full administrative access. The conditions are narrow. The flaw applies to deployments that were upgraded from a release predating the earlier CVE-2026-31986 fix, kept their existing security.properties, and have security.internal.sso.enabled set to true. The record lists affected versions as 24.09.06 and 24.09.07.
The important detail: upgrading alone does not replace a key that is already set. Affected deployments must also run ./gradlew rotateSecretKeys. Apache rates it “moderate” (CWE-321). Credit: L1nq (github.com/L1nq0).
CVE-2026-92887: REST API authentication off by default (important)
In OFBiz through 24.09.07, ModelApiReader treats a missing auth attribute in a .rest.xml operation as false, although rest-api.xsd defines the default as true. A remote unauthenticated attacker can therefore call those REST operations without credentials. Rated “important” (CWE-306, CWE-1188). Credit: Wanxin Yin (yaklang.io).
CVE-2026-109928: password-reset token gives a full session (important)
In 24.09 before 24.09.08, an attacker who holds a user’s password-reset token can submit it to the login endpoint and get a full session, including an administrator session if the target is an admin. The record gives intercepted email, exposed logs and a man-in-the-middle on mail transport as ways a token might leak. Rated “important” (CWE-303). Credit: CyberLeo (Independent Security Researcher).
CVE-2026-81815: SQL injection on MySQL/MariaDB (important)
The generic performFind service is affected on MySQL and MariaDB. A remote unauthenticated attacker sends an ignore-case find (for example _ic=Y) with a crafted backslash-terminated value. SqlJdbcUtil.addValueSingle escapes only single quotes, so the value breaks out of the string literal and turns the WHERE clause into a tautology, exposing arbitrary rows of the queried entity. The default Derby datasource and PostgreSQL are not affected. Rated “important” (CWE-89). Credits: n0mi1k (reporter) and Krishna Uprit (remediation developer).
What we don’t know yet
Severity, CWE and credits for the other 42 CVEs had not been retrieved at the time of writing; the records for CVE-2026-68524 and CVE-2026-83542 were not yet available through the CVE.org API. So it is not yet confirmed which CVEs Apache rated “critical”. Treat the three titles describing unauthenticated RCE as the highest priority until the records say otherwise.
We found no reports of in-the-wild exploitation and no CISA KEV listing for any of the 46. Searches turned up only aggregator pages about earlier 2026 OFBiz CVEs, such as CVE-2026-31986, CVE-2026-45434, CVE-2026-47342 and CVE-2026-50223.
Why OFBiz batches get attention
OFBiz has a documented exploitation history:
- December 2023: CVE-2023-51467 (CVSS 9.8), an authentication bypass that sidestepped the fix for CVE-2023-49070, was fixed in 18.12.11. Threat actors were seen attempting exploitation and VulnCheck published a proof of concept.
- 2024: CVE-2024-32113 was exploited and used to deploy the Mirai botnet. CVE-2024-38856 (CVSS 9.8, pre-auth RCE), found by SonicWall while testing the CVE-2024-36104 patch and fixed in 18.12.15, saw “pretty widespread exploitation attempts” against about 16% of SonicWall’s customer base. CISA added it to KEV with a federal deadline of 17 September 2024.
- September 2024 to February 2025: CVE-2024-45195, an unauthenticated forced-browsing RCE reported by Rapid7’s Ryan Emmons, bypassed the earlier fixes and was patched in 18.12.16. CISA added it to KEV on 4 February 2025.
CVE-2020-9496 is another previously exploited OFBiz flaw. The pattern is clear: once proof-of-concept code appears, OFBiz instances get scanned.
How to upgrade and harden
- Restrict access first. Limit the OFBiz web interface,
webtoolsand REST endpoints to trusted networks or a VPN while you prepare the upgrade. - Back up. Take a full backup of the database,
security.propertiesand any customized configuration and plugins, so you can roll back. - Upgrade to 24.09.08. It is the only fix Apache gives. Include the plugins component, since two fixes (CVE-2026-92887 and CVE-2026-114277) touch ofbiz-plugins.
- Rotate secret keys where applicable. If you upgraded from a release that predates the CVE-2026-31986 fix, kept your existing
security.properties, and have internal SSO enabled, run:
./gradlew rotateSecretKeys- Verify. Confirm the running version is 24.09.08, check that
security.internal.sso.enabledand the token key are what you expect, and review your.rest.xmlfiles so every operation declaresauthexplicitly. - Review logs. Look for unusual REST calls, unexpected admin sessions and password-reset activity, and check for unknown files under image and content paths.
If you run MySQL or MariaDB, prioritize CVE-2026-81815. If you use Janrain social login or multitenant mode, review the related CVEs closely.
Frequently asked questions
Which Apache OFBiz version fixes the 46 CVEs?
Apache OFBiz 24.09.08. The advisory says all versions before 24.09.08 are affected.
Is upgrading enough?
For most deployments, yes. Deployments affected by CVE-2026-105330 must also run ./gradlew rotateSecretKeys, because upgrading does not replace a security.token.key that is already set.
Are any of these OFBiz CVEs being exploited?
No exploitation or KEV listing had been reported for any of the 46 as of 6 November 2026. OFBiz flaws have been exploited quickly in the past, so don’t wait.
Which CVEs are rated critical?
The advisory says “some critical issues” but does not say which. The four records we checked are rated “important” or “moderate”; the others had not been retrieved.
Sources
- oss-security: Apache OFBiz CVE Announcements (4 Nov 2026)
- Apache OFBiz security page
- CVE record: CVE-2026-105330
- CVE record: CVE-2026-92887
- CVE record: CVE-2026-109928
- CVE record: CVE-2026-81815
- Dark Reading: CISA highlights Apache OFBiz flaw
- The Hacker News: CISA adds four actively exploited flaws (Feb 2025)
This article expands a story from the MAG212 CYBER Daily, 6 November 2026.