The Apache OFBiz project has fixed 46 security vulnerabilities in a single release, including at least three that let an attacker run code on the server without ever logging in. Every version before 24.09.08 is affected.

OFBiz is an open-source enterprise resource planning and e-commerce framework maintained by the Apache Software Foundation. On 4 November 2026 the project posted a list of 46 CVE identifiers to the oss-security mailing list, saying the batch contained some critical issues and advising all users to upgrade to 24.09.08.

Three flaws need no login

The most serious issue is CVE-2026-68524, a pre-authentication remote code execution flaw caused by attacker-controlled screen definition loading. A remote attacker can supply a crafted screen definition location and have the server process attacker-controlled XML as a trusted screen, leading to code execution.

A second unauthenticated code execution flaw, CVE-2026-83542, works through widget injection on the login page. It has been scored 9.8 out of 10 on the CVSS scale, the highest score in the batch. A third, CVE-2026-73578, bypasses authorisation checks on saved views without authentication, again with code execution as the impact.

The batch also includes CVE-2026-105330, a hard-coded cryptographic key in JWT authentication that can grant unauthenticated admin access, and CVE-2026-92887, in which REST endpoints skip authentication by default when the auth attribute is omitted from a definition. A flawed password-reset algorithm, CVE-2026-109928, can allow full account takeover.

A long list behind the headline

Beyond the headline flaws, the release fixes server-side request forgery, XML external entity injection and SQL injection issues, along with a set of business-logic problems. Those include cases where view-only or low-privileged users could change order prices, payment allocations and account balances.

The project has not published CVSS scores for every flaw, and the CVE records only began appearing in public databases on 5 November. Release 24.09.08 itself was tagged on 21 October, two weeks before the vulnerabilities were announced. No backports are being published for the 18.12 line or older releases, so anyone running those must move to 24.09.08.

No exploitation reported yet

As of 5 November, no confirmed exploitation in the wild and no public proof-of-concept exploit had been reported for the new flaws, and CVE-2026-68524 is not listed in CISA's Known Exploited Vulnerabilities catalogue. That is reassuring but not a reason to wait: three earlier OFBiz flaws from 2024 are already in the CISA catalogue, which means attackers have targeted this software before, and the fix code has been public since the release was tagged.

Administrators should upgrade every OFBiz instance to 24.09.08 and keep back-office interfaces off the public internet. Because the announcement gives few technical details, the practical step is to treat the upgrade as urgent and to check logs for unusual requests against login, screen and REST endpoints in the meantime.

[Source: SecNews](https://secnews.co.uk/2026/11/apache-ofbiz-24-09-08-46-cves-pre-auth-rce/) | [Source: oss-security mailing list](https://www.openwall.com/lists/oss-security/2026/11/04/9)