---
title: Apache OFBiz 24.09.08 fixes a batch of CVEs, including several unauthenticated RCE paths; every earlier version is affected | ctxsec
url: https://ctxsec.com/items/apache-ofbiz-24-09-08-46-cves-pre-auth-rce-account-takeover
description: "The Apache OFBiz project announced a large set of vulnerabilities in all versions before 24.09.08, some critical. They include pre-authentication remote code execution through attacker-controlled screen definition loading (CVE-2026-68524), unauthenticated RCE via login-page widget injection (CVE-2026-83542), a saved-view authorization bypass with RCE impact (CVE-2026-73578), a pre-auth reusable externalLoginKey (CVE-2026-82907), plus SQL injection, XXE, SSRF, path traversal and Groovy/FreeMarker sandbox escapes. OFBiz has a history of bugs being exploited quickly after disclosure."
status: "official (Apache OFBiz CVE announcement on oss-security, Nov 4; no exploitation reported)"
published: 2026-11-04
---

> The Apache OFBiz project announced a large set of vulnerabilities in all versions before 24.09.08, some critical. They include pre-authentication remote code execution through attacker-controlled screen definition loading (CVE-2026-68524), unauthenticated RCE via login-page widget injection (CVE-2026-83542), a saved-view authorization bypass with RCE impact (CVE-2026-73578), a pre-auth reusable externalLoginKey (CVE-2026-82907), plus SQL injection, XXE, SSRF, path traversal and Groovy/FreeMarker sandbox escapes. OFBiz has a history of bugs being exploited quickly after disclosure.

[← Cybersecurity News](/news) · [markdown](/items/apache-ofbiz-24-09-08-46-cves-pre-auth-rce-account-takeover.md)

official (Apache OFBiz CVE announcement on oss-security, Nov 4; no exploitation reported)

2026-11-04

### Apache OFBiz 24.09.08 fixes a batch of CVEs, including several unauthenticated RCE paths; every earlier version is affected

**What to do:** upgrade to Apache OFBiz 24.09.08. Until then, keep OFBiz (including `/webtools`) off the internet or behind a VPN or authenticating proxy. After patching, look for unexpected files under the OFBiz install, new admin users and odd requests to webtools and login pages in access logs.

Sources: [oss-security: Apache OFBiz: CVE Announcements (Jacopo Cappellato, Nov 4)](https://seclists.org/oss-sec/2026/q4/516)