The Apache OFBiz project has released version 24.09.08 to fix 46 vulnerabilities in its open-source enterprise resource planning platform, including several that allow remote code execution without authentication. The project described the batch as containing “some critical issues,” and all versions before 24.09.08 are affected.
CVE-2026-83542 and Other Unauthenticated Flaws
SecurityOnline tracked 10 of the CVEs in detail. The most severe is CVE-2026-83542, scored 9.8 on the CVSS scale, an unauthenticated remote code execution flaw that works through widget injection on the login page.
Two other unauthenticated issues stand out. CVE-2026-68524 is a pre-authentication remote code execution flaw caused by attacker-controlled loading of screen definitions. CVE-2026-73578 is an unauthenticated authorization bypass involving saved views, and it carries remote code execution impact.
Authenticated Groovy Sandbox Escapes Including CVE-2026-82960
Several of the tracked flaws require a login. CVE-2026-82912, scored 8.8, involves unsandboxed Groovy code compiled from a service parameter. CVE-2026-82960, also 8.8, lets widget expressions escape the Groovy sandbox. CVE-2026-84183 carries the same 8.8 score.
The release also addresses other vulnerability classes: SQL injection, XML external entity (XXE) processing and server-side request forgery. In addition, a hard-coded JWT key could give an attacker administrator access.
Exploitation Status and the OFBiz Track Record
No exploitation has been confirmed and no public proof-of-concept code has been reported for the 24.09.08 fixes. The project’s history is a factor in how the release is being read. CISA’s Known Exploited Vulnerabilities catalog lists three earlier OFBiz flaws from 2024: CVE-2024-32113, CVE-2024-38856 and CVE-2024-45195.
Why OFBiz ERP Data Is a Sensitive Target
OFBiz handles order, payment, catalog and human resources processes for the businesses that run it. A compromise of an internet-facing installation exposes core business records, and unauthenticated code execution would let an attacker act on the server without any account.
The Hacker News mentioned the OFBiz remote code execution issue in its Nov. 5 ThreatsDay bulletin, and SecurityOnline published its detailed breakdown of 24.09.08 on Nov. 6.
OFBiz 24.09.08 Is Separate From the Other Apache Fixes
This OFBiz release is distinct from a multi-project Apache batch covering 35 flaws that ran on Nov. 5. The two are separate sets of fixes and should not be conflated. The OFBiz release addresses only the 46 vulnerabilities in that platform.
How the OFBiz Vulnerabilities Break Down by Access Level
The coverage separates the flaws into those reachable without credentials and those that need an authenticated account. The unauthenticated group includes the widget injection, the screen-definition loading and the saved-view authorization bypass, each of which the reporting ties to code execution. The authenticated group centers on Groovy, the scripting language OFBiz uses, where sandbox restrictions either were not applied to a service parameter or could be bypassed through widget expressions.
The hard-coded JWT key is a different kind of weakness. A key embedded in the software is the same across installations, so an attacker who knows it could forge tokens and gain administrator access without exploiting a memory or injection flaw.
OFBiz 24.09.08 Is the Fixed Version
Version 24.09.08 contains the fixes. The project has not reported attacks, and the sources point to no exploit publication. Given that earlier OFBiz bugs have been added to CISA’s exploited list, the platform has drawn attacker interest before.
Business Processes Run Through OFBiz
The OFBiz platform manages order, payment, catalog and human resources processes, which means the data behind an internet-facing installation can include customer orders, payment records, product catalogs and employee information. The project’s description of “some critical issues” in the 24.09.08 release, together with the 9.8 score on CVE-2026-83542, places the unauthenticated login-page injection at the top of the list of concerns.
SecurityOnline tracked 10 CVEs out of the 46 disclosed, so the full list of fixed flaws is longer than the set detailed in public coverage. Anyone running a version earlier than 24.09.08 falls within the affected range.
