Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-83542 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-05 |
| Vendor | Apache |
| Product | OFBiz |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Apache OFBiz is an open source ERP and e-commerce system. Release 24.09.08 fixes, among others, two critical vulnerabilities affecting all platforms:
- CVE-2026-83542 (CVSS 9.8) — improper control of generation of code (Code Injection) in Apache OFBiz 24.09 before 24.09.08. A remote unauthenticated attacker stages crafted widget XML in a multipart upload and overrides the mainDecoratorLocation used by a manager login route through an anonymous JSON request. OFBiz then loads the staged XML through its live screen descriptor mechanism and evaluates an unsandboxed Groovy expression while rendering the authentication-failure page — executing arbitrary code on the server. Further validation established that the exploit does not require a malformed multipart body (a well-formed request kept in flight is sufficient), that the XML is read from a live process file descriptor while the upload is streaming, and that the same issue is also reachable through the public, unauthenticated /sfa/control/editPortalPageColumnWidth route, which returns command output directly in an HTTP 200 response.
- CVE-2026-82907 (CVSS 9.8) — authentication bypass by capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08. An attacker who captures a live externalLoginKey value obtains a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach. checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires and is not invalidated after use. The framework appends live keys to every cross-webapp link it renders, and WidgetWorker’s unvalidated inter-app link target lets an authenticated user’s key be attached to an attacker-chosen absolute URL and delivered directly to the attacker’s server.
Required Actions
Upgrade Apache OFBiz to 24.09.08 — as recommended by Apache, it fixes both vulnerabilities (along with a number of others listed on the project’s security page). Until you upgrade, restrict internet access to OFBiz instances (VPN, IP allowlist, WAF), especially to the manager application routes and /sfa/control/. After upgrading, invalidate active user sessions, review server logs for unusual multipart uploads and anonymous JSON requests, and check the server for signs of foreign code execution.
Who Is Affected?
The vulnerabilities affect organizations running Apache OFBiz (an Apache Software Foundation project) on the 24.09 branch before 24.09.08, on all platforms — as an ERP, CRM or e-commerce platform. Internet-facing instances (online stores, customer and partner portals) are at the highest risk, because CVE-2026-83542 requires no login. Also check integrator-delivered solutions built on OFBiz.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-83542 vulnerability?
CVE-2026-83542 is a code injection vulnerability in Apache OFBiz 24.09 before 24.09.08, rated CVSS 9.8. A remote unauthenticated attacker can use crafted widget XML and an anonymous JSON request to make OFBiz evaluate an unsandboxed Groovy expression, i.e. execute arbitrary code on the server.
Who is affected by CVE-2026-83542 and CVE-2026-82907?
Both vulnerabilities affect Apache OFBiz 24.09 versions before 24.09.08 on all platforms. Internet-facing OFBiz instances, such as e-commerce stores and portals built on this ERP system, are the most exposed.
How to protect against CVE-2026-83542 and CVE-2026-82907?
Apache recommends upgrading to OFBiz 24.09.08, which fixes both issues. Until you upgrade, restrict internet access to OFBiz applications; after upgrading, invalidate active sessions and review logs for unauthorized activity.
What is CVE-2026-82907?
CVE-2026-82907 (CVSS 9.8) is an authentication bypass by capture-replay of the externalLoginKey value in ExternalLoginKeysManager. The key acts as a bearer credential that is never bound to a client, never expires and is not invalidated after use, so capturing it gives the attacker a reusable session as the victim in every OFBiz webapp the victim can reach.
