External risk intelligence

Apache OFBiz Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-83542

Apache OFBiz is an enterprise-grade ERP system commonly deployed as an internet-facing web application. This vulnerability is reachable via unauthenticated HTTP routes, including public-facing endpoints, allowing remote code execution without prior authentication. Because these services are designed to be accessed via web requests, the attack surface is exposed by default.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Apache OFBiz, an enterprise resource planning system. This issue allows unauthenticated remote attackers to execute arbitrary code on the server, potentially impacting the confidentiality, integrity, and availability of systems running this software. The main concern at this time is confirming relevance and exposure within our environment.

Allows remote code execution without authentication.
High impact to server integrity and availability.
Confirm relevance and exposure for OFBiz systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted anonymous request to an OFBiz server. This request, which involves uploading a malicious XML file through a multipart upload and a JSON request, tricks the server into loading and processing the unsafe XML. This leads to the execution of arbitrary code on the server when the system attempts to render an authentication failure page or through a public portal page editing route.

Requires unauthenticated network access.
Triggered by uploading crafted XML.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated attacker could execute arbitrary code on the server by manipulating OFBiz's screen descriptor mechanism. This could occur when a specially crafted XML file is staged during a multipart upload and then loaded while rendering an authentication-failure page or through a public, unauthenticated route.

Server-side code execution.
Unauthenticated requests may trigger execution.
Compromised server integrity and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Apache OFBiz deployments are likely managed by application owners, platform teams, and infrastructure teams, with support from network and security teams. The first actionable step is to identify all OFBiz instances, determine their exposure and criticality, and locate the accountable owner for each. Subsequent planning should prioritize remediation efforts based on assessed risk.

Ownership: Application and platform teams.
Verify first: System exposure and criticality.
Action: Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache OFBiz?

Apache OFBiz is an enterprise resource planning (ERP) software framework. It provides a suite of business tools—such as accounting, manufacturing, and inventory management—designed to run large-scale web applications. Because it serves as the foundation for these business-critical operations, it is frequently configured to handle complex data and user interactions over the network.

What does CWE-94 mean for CVE-2026-83542?

CWE-94, or Improper Control of Generation of Code, refers to a weakness where an application allows user-supplied data to influence the code it executes. In this CVE, the software incorrectly processes crafted XML input, which then triggers the execution of unsandboxed Groovy expressions. Essentially, the system is tricked into running commands provided by an attacker instead of just processing legitimate data.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted multipart HTTP request to the server. The process involves staging malicious XML in an upload and then using an anonymous JSON request to target specific routes, such as a login path or a public portal page. The bug is triggered even when the multipart request completes normally; it does not require malformed data or persistence to the disk.

Is my system at risk if it is not on the internet?

Halo Surface Signal indicates that Apache OFBiz is very likely to be an internet-facing application, making the default attack surface significant. While internet-facing instances are at higher risk, any environment where unauthorized users can reach these specific unauthenticated HTTP routes could be targeted. You should evaluate access controls regardless of whether the system sits behind a firewall.

Do I need to update my software?

Yes, you should prioritize updating to Apache OFBiz version 24.09.08. Start by identifying all instances of OFBiz in your environment and confirming which versions are currently active. Once inventory is complete, work with the responsible application and platform teams to coordinate the upgrade, as this version contains the necessary changes to fix the underlying code injection flaw.

References

lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.