CVE-2026-83542: Apache OFBiz: Unauthenticated RCE via login-page widget injection
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 1.2%
EPSS score, percentile 69.1 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 9.8 Critical
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- before 24.09.08
Source: CISA KEV 2026.11.10, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
Apache OFBiz: Unauthenticated RCE via login-page widget injection
Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following: -- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient. -- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk. -- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (1 product)
| Status | Versions |
|---|---|
| Affected | before 24.09.08 |
Versions not listed are: unaffected.
Source: CVE List, as of . About the data.
Weakness
CWE-94
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
Known exploited Apache vulnerabilities
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability