critical advisory November 4, 2026

Apache OFBiz: Multiple vulnerabilities (CVE-2026-66903, CVE-2026-68524)

Apache OFBiz versions prior to 24.09.08 are vulnerable to critical flaws including authenticated path traversal in Catalog Image Management and pre-authentication remote code execution.

Triage facts

Revision 1

Applicability: OFBiz (< 24.09.08)
Evidence: Unknown
Severity: Critical
Action: Immediate escalation
Sources: 1 public source
Freshness: Revision 1Nov 4, 21:08 UTC
Vulnerabilities: 2 CVEs
Source quality: A1Likely

The Apache Software Foundation has released security updates for Apache OFBiz to address multiple vulnerabilities, including two identified CVEs. The most severe issue allows for pre-authentication remote code execution, while the second vulnerability enables path traversal within the Catalog Image Management component. These vulnerabilities affect all versions prior to 24.09.08.

Impact

Successful exploitation of CVE-2026-68524 could allow an unauthenticated attacker to execute arbitrary code on the underlying server. CVE-2026-66903 could allow an authenticated user to perform unauthorized file system access.

Recommendation

Upgrade all instances of Apache OFBiz to version 24.09.08 or later immediately.
Audit existing OFBiz installations for suspicious access patterns to the Catalog Image Management component.
Review web server access logs for anomalous requests to screen-related endpoints that may indicate attempts to trigger the pre-authentication RCE.

Immediate actions

Patch Apache OFBiz to 24.09.08

IT Operations 24h

Threat Hunt

Identify unauthenticated access to screen-related application endpoints

T1190 high medium confidence hunt now

Data: Web server access logs (cs-uri-stem, cs-method, sc-status)

Mitigations

Upgrade to 24.09.08

immediate IT Operations

CVE-2026-66903, CVE-2026-68524