Apache lists 46 OFBiz CVEs, 3 titled unauthenticated RCE; their fixes were public 82 days earlier

82 days between the public fix and the CVE list (derived)

Apache's OFBiz project posted a list of 46 CVEs to its user mailing list at 16:13:17 UTC on 4 November 2026, all fixed in version 24.09.08. Three of the 46 are titled as unauthenticated or pre authentication code execution. The pull requests that the project's own security page lists as the fixes for those three had been merged to the public release24.09 branch by 16:04:07 UTC on 14 August. From that merge to the CVE list is 82 days and 9 minutes (derived).

That figure does not say anyone used the time. No record read for this brief reports exploitation, a public exploit, a count of exposed OFBiz servers, or anyone reading those pull requests with bad intent. It says only that the change was on a public page, in a public repository, long before the advisory. It also does not mean a packaged fix existed for those 82 days: the packaged release was announced on 3 November, and that is the date most operators can act on.

All statements about the catalogue, the CVE records and the OFBiz pages are as read at about 09:36 UTC on Sunday 8 November 2026. OFBiz is an open source enterprise resource planning and commerce suite, so the records in question touch orders, payments, staff and catalogue data.

A tag is not a release: the record in order

The tag object for release24.09.08 carries a tagger date of 19:53:28 UTC on 21 October. A tagger date is written by the person making the tag and says nothing about when it reached the public repository. It was a release candidate: the fourth vote on the project's development list opened 16 minutes and 20 seconds later (derived). The third attempt had been cancelled that morning "to include latest fix commit on this release".

The vote result was posted at 09:03:39 UTC on 2 November: thirteen +1 votes, ten of them binding. The release announcement followed at 10:35:09 UTC on 3 November. The download page gives only "Released in November 2026" and no day; the mailing list supplies the day. The file timestamps on the Apache download host could not be checked, because its robots file disallows this reader.

So the two week gap that the tag date suggests is not the gap operators faced. Release announcement to CVE list was 1 day, 5 hours and 38 minutes (derived). The announcement itself said nothing about security severity: it pointed to the release notes and the security page. The CVE records followed between 13:33 and 14:12 UTC on 5 November.

Zoom

Between 14 August and 3 November an operator on the packaged 24.09.07 release, released in June 2026, had no packaged fix for these three: 80 days 18 hours (derived). The same is true of 24.09.06, released in May 2026. Both are inside the affected range, so an upgrade in May or June does not help; the security page lists all 46 as affected before 24.09.08.

What a reader of the public repository could see

Only the six pull requests behind the three titled RCE flaws were read for this brief; the other 43 CVEs were not traced to their pull requests. For those three, the trunk versions merged first: pull request 1512 on 30 July, 1624 and 1650 on 14 August, each before its release branch copy.

The wording was not hidden. Pull request 1654 says, in the public description, that it would "stop anonymous JSON request bodies from overriding request attributes". The CVE description of CVE-2026-83542, published 83 days later (derived, by calendar day), says the attack works "through an anonymous JSON request". Pull request 1653 names _LAST_VIEW_NAME_, the same parameter named in the description of CVE-2026-73578. The vote emails also said "The release files can be downloaded from here" about candidate files on Apache's development distribution area; this site did not fetch them.

That is the whole of what the record shows about the window. It does not show when each change was first understood as a security fix by anyone outside the project, whether a reader connected the change to a live flaw, or whether Apache kept any part of the fixes private. The record does not give the project's reasons for the order of events. The effect is a window in which a reader of the code could be ahead of an operator who waits for a release.

Apache's words: one critical, 29 important, 16 moderate (derived)

Every one of the 46 CVE records carries a severity word from Apache and no numeric score of Apache's own. The tally, counted by this site, is 1 critical, 29 important, 16 moderate. The list email says "including some critical issues" in the plural; the only record marked critical is CVE-2026-83542. CVE-2026-68524, titled pre authentication remote code execution, carries "important".

Zoom

Titles are a floor rather than a map. Fifteen descriptions use the word unauthenticated (derived), which adds five titles that say nothing about login: CVE-2026-81815, CVE-2026-82894, CVE-2026-82904, CVE-2026-92887 and CVE-2026-114229, each with its own conditions. CVE-2026-82894 for example needs a row that an account with content rights has already set.

The three no login titles also differ from their descriptions. CVE-2026-83542's description says plainly that an unauthenticated attacker can execute arbitrary code. CVE-2026-68524's says an attacker can load an attacker controlled screen definition and does not use the words code execution. CVE-2026-73578's title says "with RCE impact", while its description says only "potentially exposing protected views and associated business data". The six descriptions that do state code or command execution are CVE-2026-82910, 82912, 82960, 83542, 84183 and 85627; five of those six require a login.

Labels doing the work of a control

"Important". A word on a CVE record is an assessment, not a condition of the flaw. CVE-2026-68524 is important and titled pre authentication RCE. CVE-2026-105330 is titled as giving unauthenticated administrative access and is marked moderate; its description sets conditions, and the record does not explain the word. Neither word tells an operator whether their own server meets those conditions.

"Improved". The release notes do list these changes under a heading of Security fixes, and of the 53 entries there 26 begin with the word Improved (derived). The pull request merged on 30 July was titled as a hardening of screen location validation. A label like that is accurate and tells a skimming operator nothing about urgency.

"Upgrade". Apache's list gives one mitigation: upgrade. For CVE-2026-105330 the record adds what the email does not: "Upgrading alone does not replace an already-configured key". Deployments that carried a security properties file forward from before the fix for CVE-2026-31986, with internal single sign on enabled, must also run a key rotation task. An operator who reads only the list will install the release, see the version number change, and may still hold the factory key.

What the records state, and what they do not

CISA's catalogue does hold three older OFBiz entries: CVE-2024-32113 (added 7 August 2024), CVE-2024-38856 (27 August 2024) and CVE-2024-45195 (4 February 2025). That is history for this product and not evidence about the 46. The US National Vulnerability Database shows CVE-2026-83542 as Undergoing Analysis, with CISA's score the only one attached, and the other two lead records as Awaiting Analysis.

Where the sources differ

On the 18.12 series the records do not settle the question: a description that names only 24.09 does not say older branches are safe, and the affected field implies they are not. No record names a fixed 18.12 release; the project's download page offers 24.09.08 as the download.

What to do, in order

Technical details

Fixed version and affected range, as Apache's email prints them. This is the whole of the mitigation advice in the list. Compare it with your running version.

Affected versions: All versions prior to 24.09.08.

Mitigation:
Users are advised to upgrade to Apache OFBiz 24.09.08, which addresses
these vulnerabilities.

Tag object fields, as GitHub returned them. The first line is the tag and the second its tagger date, which is a claim by the tagger and not a push time. Defenders can compare the tag against the version they deployed.

"tag":"release24.09.08"
"date":"2026-10-21T19:53:28Z"

The description of CVE-2026-68524 as printed. It names the mechanism in general terms. A defender uses it to understand why the fix restricts how screen definitions load.

An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition.



This issue affects Apache OFBiz: before 24.09.08.



Users are recommended to upgrade to version 24.09.08, which fixes the issue.

The description of CVE-2026-73578 as printed. The named parameter is where a defender would look in request logging, if that logging records it.

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW_NAME_ value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

The description of CVE-2026-83542 as printed, the one record Apache marks critical. The route it names is the log search in the checklist. One long dash in the record is shown here as a hyphen, because this site does not print long dashes; nothing else is changed.

Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:

-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.

-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.

-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response - it is not limited to the login-failure rendering path used in the original report.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Paths and view names printed in the records, for log searches only. These three strings appear in the descriptions of CVE-2026-83542, CVE-2026-73577 (as the record's own example of a suffix on a public path) and CVE-2026-82894. Each on its own is a route or view name, nothing more. Search web server and application logs for requests to them and judge each hit in context.

/sfa/control/editPortalPageColumnWidth
/catalog/control/ListLocales/showPortalPage
showHelpPublic

The extra step in CVE-2026-105330, as printed. Run the command only if the condition applies to your deployment.

Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.

The list as printed, grouped. The three blocks below hold all 46 titles. Grouping by what the title says about login is this site's and is derived; within each block the lines are Apache's, in Apache's order, with only the email's line wrapping rejoined. Use them to match a CVE from a scanner to its title.

CVE-2026-68524: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
CVE-2026-73577: Unauthenticated path-suffix view authorization bypass
CVE-2026-73578: Unauthenticated saved-view authorization bypass with RCE impact
CVE-2026-73580: Unauthenticated HR organization and employee disclosure
CVE-2026-74841: Denial of Service via unauthenticated userTenantId in multitenant mode
CVE-2026-82907: externalLoginKey honoured pre-auth, reusable and unbound
CVE-2026-83538: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
CVE-2026-83542: Unauthenticated RCE via login-page widget injection
CVE-2026-97355: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service
CVE-2026-105330: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

CVE-2026-66903: Authenticated Path Traversal in Catalog Image Management
CVE-2026-76150: Authenticated path traversal and missing authorization check in replaceImageToExistImage
CVE-2026-76152: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services
CVE-2026-82960: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
CVE-2026-84183: Content Manager VIEW-only RCE in updateLayout
CVE-2026-85627: Authenticated Code Execution Vulnerability
CVE-2026-105325: Missing authorization in payment application services allows view-only users to modify payment allocations
CVE-2026-105461: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities

CVE-2026-71901: Dispatch arbitrary internal services on SFA component
CVE-2026-81734: Missing authorization - catalog quick-admin product writes
CVE-2026-81744: Authorization bypass - self-grant content OWNER
CVE-2026-81808: Missing authorization - search-result bulk catalog mutation
CVE-2026-81815: SQL injection - performFind ignore-case values, MySQL/MariaDB
CVE-2026-81816: XML external entity injection (XXE)
CVE-2026-81828: Server-side request forgery in SurveyWrapper
CVE-2026-82894: Content renderer runs a service name stored on the row
CVE-2026-82902: Unfiltered server-side URL fetch in webtools viewdatafile
CVE-2026-82904: Unbounded multi-form row count from a parameter name
CVE-2026-82910: renderLink compiles link parameters as FreeMarker source
CVE-2026-82912: Unsandboxed Groovy compiled from a service parameter
CVE-2026-82916: webtools xmldsdump exports any entity to any path
CVE-2026-84728: Cross-tenant authorization bypass in mapped-domain login
CVE-2026-92887: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
CVE-2026-97356: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass
CVE-2026-100168: Missing Authorization vulnerability
CVE-2026-100228: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
CVE-2026-109129: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification
CVE-2026-109837: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association
CVE-2026-109856: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
CVE-2026-109928: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
CVE-2026-114229: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session
CVE-2026-114233: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
CVE-2026-114235: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
CVE-2026-114271: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification
CVE-2026-114272: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure
CVE-2026-114277: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts

Severity word for each CVE. The words are Apache's, from each record. Numeric scores are left out here because none is Apache's.

The question Apache's notice leaves open

Apache's list tells an operator to upgrade and gives no dates. The fix for the one flaw it marks critical had been readable for 82 days when the list arrived, and the release had been out for about a day. If security work ships through public pull requests, who was supposed to tell an operator of the packaged 24.09.07, on 14 August, that the screens exposed to the internet should come off it?

Key facts