Apache OFBiz before 24.09.08: unauthenticated code execution on the login path. Upgrade this week

Apache OFBiz published a large security drop on November 4. Among the fixes is CVE-2026-83542, an unauthenticated remote code execution bug that loads attacker-controlled widget XML through the login-page renderer and runs unsandboxed Groovy.

Every release before 24.09.08 is affected. The project’s mitigation is the upgrade. There is no separate workaround list for the critical unauthenticated paths.

Unauthenticated OFBiz RCE is back on the login path. If you still run anything before 24.09.08, schedule the upgrade before the weekend scanners arrive.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Apache OFBiz ships a pile of critical fixes

Jacopo Cappellato posted the CVE list to oss-security on November 4. The OFBiz security page now lists dozens of fixed issues in 24.09.08, including several unauthenticated remote code execution and authentication-bypass bugs.

CVE-2026-83542 lets a remote attacker with no account stage crafted widget XML through a multipart upload and override the decorator used by a manager login route. OFBiz then evaluates Groovy while rendering the authentication-failure page. The same underlying issue is also reachable through the public, unauthenticated /sfa/control/editPortalPageColumnWidth route, which can return command output in an HTTP 200 response.

CVE-2026-68524 is another pre-authentication RCE path through attacker-controlled screen definition loading. CVE-2026-82907 is an authentication bypass: a captured externalLoginKey is honoured before auth, reusable and unbound.

• Affected: all Apache OFBiz releases before 24.09.08.
• Fixed: 24.09.08. Download from the official OFBiz download page and follow the project’s upgrade notes.

ERP and commerce stacks still on older 24.09 builds

OFBiz shows up as the engine under custom ERP, order-management and e-commerce deployments. Unauthenticated RCE on a login or SFA route is the kind of bug that gets a mass scan within days of the oss-security post. Instances left on the public internet are first.

OFBiz has a long history of unauthenticated RCE bugs that were exploited after disclosure. Treating 24.09.08 as a same-week upgrade, not a backlog item, matches how those earlier waves played out.

Upgrade every OFBiz instance to 24.09.08

• Identify every OFBiz instance (application servers, containers, vendor appliances that embed it) and record the version from the about or release file.
• Upgrade each one to 24.09.08 from the official Apache download, then restart and confirm the new version.
• Until the upgrade is done, keep OFBiz off the public internet and restrict management and SFA routes to trusted networks.
• After upgrading internet-facing instances, review access logs for multipart uploads to login-related routes and for hits on /sfa/control/editPortalPageColumnWidth.

Details

• CVE-2026-83542: unauthenticated RCE via login-page widget injection / Groovy evaluation; also reachable at /sfa/control/editPortalPageColumnWidth.
• CVE-2026-68524: pre-authentication RCE via attacker-controlled screen definition loading.
• CVE-2026-82907: externalLoginKey honoured pre-auth, reusable and unbound.
• Fixed: Apache OFBiz 24.09.08 (oss-security announcement November 4, 2026). Exploitation: none reported in the announcement.

Hunt / verify

• Find OFBiz processes and install paths: look for ofbiz.jar, ofbiz.zip, or containers image-named ofbiz.
• In HTTP logs, search for multipart POSTs around login and for requests to /sfa/control/editPortalPageColumnWidth.
• Compare the running build against 24.09.08; anything older is in scope.

Source: OFBiz security page; oss-security CVE announcement

Sources

• Apache OFBiz: Security (fixed in 24.09.08)
• oss-security: Apache OFBiz CVE Announcements (November 4, 2026)
• Apache OFBiz downloads
• CVE.org: CVE-2026-83542
• CVE.org: CVE-2026-68524
• CVE.org: CVE-2026-82907

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].