Cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aapacheofbiz/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 21:08:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache OFBiz: Multiple vulnerabilities (CVE-2026-66903, CVE-2026-68524)https://feed.craftedsignal.io/briefs/2026-11-apache-ofbiz/Wed, 04 Nov 2026 21:08:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-ofbiz/Apache OFBiz versions prior to 24.09.08 are vulnerable to critical flaws including authenticated path traversal in Catalog Image Management and pre-authentication remote code execution.The Apache Software Foundation has released security updates for Apache OFBiz to address multiple vulnerabilities, including two identified CVEs. The most severe issue allows for pre-authentication remote code execution, while the second vulnerability enables path traversal within the Catalog Image Management component. These vulnerabilities affect all versions prior to 24.09.08.

Impact

Successful exploitation of CVE-2026-68524 could allow an unauthenticated attacker to execute arbitrary code on the underlying server. CVE-2026-66903 could allow an authenticated user to perform unauthorized file system access.

Recommendation

  • Upgrade all instances of Apache OFBiz to version 24.09.08 or later immediately.
  • Audit existing OFBiz installations for suspicious access patterns to the Catalog Image Management component.
  • Review web server access logs for anomalous requests to screen-related endpoints that may indicate attempts to trigger the pre-authentication RCE.
]]>criticaladvisory