{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapacheofbiz/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-66903"},{"id":"CVE-2026-68524"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OFBiz (\u003c 24.09.08)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eThe Apache Software Foundation has released security updates for Apache OFBiz to address multiple vulnerabilities, including two identified CVEs. The most severe issue allows for pre-authentication remote code execution, while the second vulnerability enables path traversal within the Catalog Image Management component. These vulnerabilities affect all versions prior to 24.09.08.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-68524 could allow an unauthenticated attacker to execute arbitrary code on the underlying server. CVE-2026-66903 could allow an authenticated user to perform unauthorized file system access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Apache OFBiz to version 24.09.08 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing OFBiz installations for suspicious access patterns to the Catalog Image Management component.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests to screen-related endpoints that may indicate attempts to trigger the pre-authentication RCE.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T21:08:40Z","date_published":"2026-11-04T21:08:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-ofbiz/","summary":"Apache OFBiz versions prior to 24.09.08 are vulnerable to critical flaws including authenticated path traversal in Catalog Image Management and pre-authentication remote code execution.","title":"Apache OFBiz: Multiple vulnerabilities (CVE-2026-66903, CVE-2026-68524)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-ofbiz/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}