Apache OFBiz 24.09.08 fixes a batch of CVEs, including several unauthenticated RCE paths; every earlier version is affected
What to do: upgrade to Apache OFBiz 24.09.08. Until then, keep OFBiz (including /webtools) off the internet or behind a VPN or authenticating proxy. After patching, look for unexpected files under the OFBiz install, new admin users and odd requests to webtools and login pages in access logs.
Sources: oss-security: Apache OFBiz: CVE Announcements (Jacopo Cappellato, Nov 4)