Apache OFBiz 24.09.08 fixes 46 flaws including unauthenticated remote code execution (CVE-2026-68524, CVE-2026-83542)

TLDR

• Apache OFBiz 24.09.08 fixes 46 vulnerabilities, including critical issues, and the project says all earlier versions are affected.²⁵
• CVE-2026-68524 and CVE-2026-83542 let an unauthenticated attacker run code; CVE-2026-83542 is rated 9.8 by NVD.⁷⁸
• Ostorlab says CVE-2026-68524 is not in CISA's KEV catalogue and no exploitation is known; the fix is 24.09.08.⁵

The Hacker News' ThreatsDay roundup of 5 November reports that the maintainers of Apache OFBiz have addressed 46 security flaws, including CVE-2026-68524, which could result in pre-authentication remote code execution, and CVE-2026-109928, which enables full account takeover due to an incorrect authentication algorithm implementation.¹ It says the issues are patched in Apache OFBiz 24.09.08.¹ The project announced the batch on the oss-security mailing list on 4 November 2026, saying multiple vulnerabilities, including some critical issues, affect all versions prior to 24.09.08 and advising users to upgrade to that release.² The project's security page lists the CVEs as fixed in 24.09.08, and Ostorlab reports that the project announced 46 CVEs in the release.³⁵

Two of the flaws are unauthenticated code execution. The CVE record for CVE-2026-68524 says an unauthenticated attacker can exploit temporary-file handling, access an open file descriptor and inject a "file:" URI to make OFBiz load an attacker-controlled screen definition.⁷ The record for CVE-2026-83542 says a remote unauthenticated attacker can stage crafted widget XML in a multipart upload and override the mainDecoratorLocation used by a manager login route through an anonymous JSON request, so that OFBiz evaluates an unsandboxed Groovy expression while rendering the authentication-failure page.⁸ It adds that the same issue is reachable through the unauthenticated /sfa/control/editPortalPageColumnWidth route, which returns command output in an HTTP 200 response, and lists a CVSS v3.1 base score of 9.8 from NVD.⁸ Ostorlab says the code runs in the OFBiz Java process as the operating-system user that runs OFBiz.⁵ The release notes list the fix as restricting widget resource locations to component:// or an explicit allowlist, and the security page ties that change (PR 1654) to both CVEs.³⁴ SecurityOnline adds that CVE-2026-73578, an unauthenticated saved-view authorisation bypass, has "RCE impact", and that several authenticated flaws also lead to code execution.⁶

On who found the flaws, the CVE records as relayed by NotCVE credit Naoya Takahashi (nakko) for CVE-2026-68524 and Jonah Burgess (CryptoCat), Krishna Uprit, David Crees and Abstract Shield for CVE-2026-83542.⁷⁸ Both records also credit Jacopo Cappellato, who sent the oss-security announcement.²⁷⁸ NotCVE shows both records as published on 5 November 2026, the same day as the roundup.⁷⁸ The roundup itself does not name the researchers.¹

The sources differ or leave points open. The announcement says all versions before 24.09.08 are affected, while the CVE-2026-83542 record limits that flaw to OFBiz 24.09 before 24.09.08.²⁸ Ostorlab's table lists 24.09.01 to 24.09.07, 18.12.19 and earlier, and every 17.12 and older release as affected, and says the project publishes no workaround for the batch.⁵ The CVE-2026-105330 record, a hard-coded JWT key flaw, limits that issue to 24.09.06 and 24.09.07 and says upgrading alone does not replace an already-configured key, so deployments that carried an older security.properties forward must also run './gradlew rotateSecretKeys'.⁹ On CVE-2026-109928, The Hacker News says it enables full account takeover, while the CVE record says the attacker must first have obtained a user's password-reset token.¹¹⁰ On exploitation, SecurityOnline reports none confirmed and no public proof of concept, and says CISA's Known Exploited Vulnerabilities catalogue already lists three 2024 OFBiz flaws; Ostorlab says no public exploit code has been published for CVE-2026-68524, CVE-2026-83542 or CVE-2026-73578.⁵⁶ SecurityOnline shows CVE-2026-68524 as awaiting analysis, without a CVSS score.⁶

Why it matters: two of the 46 flaws let an unauthenticated attacker run code on a reachable OFBiz server, and SecurityOnline says the software runs order, payment, catalogue and HR processes.⁶⁷⁸