Apache OFBiz update fixes 46 flaws, including unauthenticated RCE

Apache OFBiz has released a 24.09.08 update addressing 46 security flaws across its open‑source ERP suite, affecting all versions prior to 24.09.08. The advisory notes several critical issues, with multiple flaws enabling unauthenticated remote code execution (RCE).

Notable CVEs cited as fixed or mitigated include CVE-2026-83542 (unauthenticated RCE via login-page widget injection), CVE-2026-68524 (pre-authentication RCE through attacker‑controlled screen definition loading), CVE-2026-73578 (unauthenticated saved-view authorization bypass with RCE impact), CVE-2026-82912 (authenticated RCE via unsandboxed Groovy from a service parameter),

CVE-2026-82960 (Groovy sandbox escape via widget expressions), CVE-2026-84183 (Content Manager with VIEW rights able to run code), and CVE-2026-105330 (hard‑coded JWT key enabling unauthenticated administrative access). Other entries include CVE-2026-82960, CVE-2026-84728 (multitenant cross‑tenant login bypass), CVE-2026-68524 and CVE-2026-73578, with several additional flaws described as awaiting analysis. The article notes that “Actively exploited” claims are not confirmed for this batch.

The OFBiz project states that all versions before 24.09.08 are affected and that no public PoCs or confirmed in‑the‑wild exploitation have been reported for this release. Workarounds and mitigations include upgrading to OFBiz 24.09.08 and keeping admin and webtools interfaces off the public Internet, alongside consulting the OFBiz security page for the full vulnerability list. The update is described as urgent given OFBiz’s handling of core business processes such as orders, payments, and HR.

The report attributes each claim to the vulnerabilities’ CVEs and the advisory, noting the highest-severity entry carries a CVSSv3 score of 9.8 (CVE-2026-83542) and that several other flaws are not exploited at the time of writing. 6 November 2026.