{"slug":"apache-ofbiz-preauth-rce-cve-2026-83542","title":"Apache OFBiz pre-auth RCE (CVE-2026-83542)","shortName":"Apache OFBiz","seoTitle":"Apache OFBiz (CVE-2026-83542): versions, exploitation & detection","summary":"Unauthenticated code injection in Apache OFBiz (CVE-2026-83542, CWE-94); CryptoCat's lab demonstration of CVE-2026-83542 is lab-validated and deployment-specific, not a blanket Public PoC: RCE mark. CISA ADP CVSS 3.1 9.8 on the NVD record (Secondary); Apache CNA published a textual critical rating with no numeric CVSS. Related CVE-2026-68524 is pre-auth RCE via untrusted screen-resource loading, and CVE-2026-73578 is an unauthenticated saved-view authorization bypass with RCE impact. Apache announced 46 CVEs in 24.09.08; those three are the pre-auth RCE-class bugs on this page. Affected: all versions prior to 24.09.08. Fixed in 24.09.08. Not in CISA KEV (catalog 2026.11.04, checked 6 Nov 2026). Badge: No known ITW as of 7 Nov 2026.","isExample":false,"draft":false,"family":"apache-ofbiz-preauth-rce-cve-2026-83542","kind":"single-product","aliases":["CVE-2026-83542","CVE-2026-68524","CVE-2026-73578","GHSA-98rg-5rx4-6c7x","GHSA-jcx6-8pcq-frpq","GHSA-8q8q-2cjc-7vh5","Apache OFBiz pre-auth RCE","OFBiz widget injection"],"publishedAt":"2026-11-07","updatedAt":"2026-11-07","patchStatus":"patched","exploited":false,"scores":{"cve":"CVE-2026-83542","cvss":{"cve":"CVE-2026-83542","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cisa-adp","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83542","sourceDate":"2026-11-06","checkedDate":"2026-11-06","dateLabel":"CISA ADP dated","sourceLabel":"CISA ADP on the NVD record (Secondary CVSS 3.1 9.8, source 134c704f-9b21-4f2e-91b3-4a467353bcc0). Apache CNA published a textual critical rating with no numeric CVSS. No NVD-produced Primary as of 6 Nov 2026. GHSA-98rg-5rx4-6c7x also shows CVSS 9.8.","nvdPublishedDate":"2026-11-05"},"epss":{"cve":"CVE-2026-83542","score":0.01069,"percentile":0.64974,"date":"2026-11-06","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-83542","checkedDate":"2026-11-06"},"kev":{"cve":"CVE-2026-83542","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.04","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-06"},"addedDate":"2026-11-07"},"priority":{"label":"high"},"managementSummary":{"what":"Unauthenticated code injection in Apache OFBiz (CVE-2026-83542, CWE-94); CryptoCat's lab demonstration of CVE-2026-83542 is lab-validated and deployment-specific, not a blanket Public PoC: RCE mark. CISA ADP CVSS 3.1 9.8 on the NVD record (Secondary). Related CVE-2026-68524 is pre-auth RCE via untrusted screen-resource loading; related CVE-2026-73578 is an unauthenticated saved-view authorization bypass with RCE impact. Apache announced 46 CVEs in 24.09.08; those three are the pre-auth RCE-class bugs on this page. Not in CISA KEV (checked 6 Nov 2026). No known ITW as of 7 Nov 2026.","action":"Upgrade to Apache OFBiz 24.09.08. Restrict exposure and admin access until patched. CryptoCat (not Apache): review non-default security.allowFilePaths values against the 24.09.08 default-deny behaviour. CryptoCat's lab method is deployment-specific; network or proxy behaviour is not a software fix. Still upgrade to 24.09.08."},"whatChanged":{"date":"2026-11-07","items":[{"text":"New catalog page for Apache OFBiz pre-auth RCE CVE-2026-83542, with related CVE-2026-68524 and CVE-2026-73578 from the same 24.09.08 release.","headline":"New catalog page for Apache OFBiz pre-auth RCE CVE-2026-83542","section":"overview","date":"2026-11-07","kind":"page"},{"text":"Apache 24.09.08 fixes 46 CVEs. Jacopo Cappellato (oss-security, 4 Nov 2026): all versions prior to 24.09.08 are affected; upgrade to 24.09.08. This page covers three pre-auth RCE-class bugs from that batch: CVE-2026-83542, CVE-2026-68524, and CVE-2026-73578. The other CVEs in the same release are not this bug and are not covered by the CryptoCat lab demonstration.","headline":"Apache 24.09.08 fixes 46 CVEs; three pre-auth RCE-class bugs on this page","section":"fixed-versions","date":"2026-11-07","sourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/04/9","alsoSourceUrl":"https://ofbiz.apache.org/security.html"},{"text":"No known in-the-wild use as of 7 Nov 2026. CISA ADP SSVC Exploitation is none (timestamp 2026-11-06T04:56:29.596160Z). Badge: No known ITW. CryptoCat published a researcher-run lab demonstration of CVE-2026-83542 only; it is lab-validated and deployment-specific, not production exploitation. Not in CISA KEV (catalog 2026.11.04, released 2026-11-04T20:00:05.774Z, checked 6 Nov 2026).","headline":"No known ITW; CryptoCat lab demo is deployment-specific; not in KEV","section":"exploitation","date":"2026-11-07","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/"}]},"whatTheBugIs":"CVE-2026-83542 is unauthenticated code injection (CWE-94) in Apache OFBiz. Apache CNA titles it Unauthenticated RCE via login-page widget injection. Jacopo Cappellato announced a batch of 46 CVEs on 4 Nov 2026 (oss-security). This page covers three pre-auth RCE-class bugs from that batch: CVE-2026-83542, CVE-2026-68524, and CVE-2026-73578. The other CVEs in the same release are not this bug and are not covered by the CryptoCat lab demonstration. Apache: all versions prior to 24.09.08 are affected. Upgrade to 24.09.08.\n\nCVE-2026-83542. Apache CNA: Improper Control of Generation of Code (Code Injection), CWE-94, textual severity critical, no numeric CVSS from Apache. Affected versions object: 0 lessThan 24.09.08. Credits: Jonah Burgess (CryptoCat) reporter; Krishna Uprit remediation developer; David Crees, Abstract Shield reporter. CryptoCat: reported to Apache on 2 Aug 2026. NVD published 5 Nov 2026 14:17:06.820, lastModified 6 Nov 2026 12:17:22.267, vulnStatus Undergoing Analysis. CVSS 3.1 9.8 is the NVD Secondary metric from CISA ADP (source 134c704f-9b21-4f2e-91b3-4a467353bcc0), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No NVD-produced Primary as of 6 Nov 2026. GHSA-98rg-5rx4-6c7x (unreviewed) also shows CVSS 9.8 and CWE-94. FIRST EPSS on 6 Nov 2026: 0.01069 (64.974th percentile). A reachable OFBiz app can treat untrusted content as a trusted screen or widget resource; rendering may evaluate attacker-supplied script in the Java process. Code runs as the OFBiz service account, not necessarily root. This page stays high level. It does not describe payloads, staging details, or reproduction steps.\n\nCVE-2026-68524. Apache CNA title: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading. CWE-94. Textual severity important. No numeric CVSS from Apache, NVD, or GHSA-jcx6-8pcq-frpq as of 6 Nov 2026. Do not infer a score from the batch. Credit: Naoya Takahashi (nakko) reporter. NVD published 5 Nov 2026 15:17:22.090, vulnStatus Received, empty metrics. FIRST EPSS on 6 Nov 2026: 0.00216 (12.077th percentile). Attribution, path, and evidence for this CVE stay on this CVE. It is not the CryptoCat 83542 lab demonstration.\n\nCVE-2026-73578. Apache CNA title: Unauthenticated saved-view authorization bypass with RCE impact. CWE-288. Textual severity important. No numeric CVSS from Apache, NVD, or GHSA-8q8q-2cjc-7vh5 as of 6 Nov 2026. Credits: Jonah Burgess (CryptoCat) finder; Krishna Uprit remediation developer. NVD published 5 Nov 2026 15:17:22.497, vulnStatus Received, empty metrics. FIRST EPSS on 6 Nov 2026: 0.00330 (26.290th percentile). CryptoCat published a separate analysis of this CVE. That write-up is original research on this page, not a /pocs entry. The CNA description mentions Apache OFBiz 24.09 before 24.09.08; the affected versions object is still 0 lessThan 24.09.08, matching oss-security: all versions prior to 24.09.08 are affected.\n\nExploitation. No known in-the-wild use as of 7 Nov 2026. Badge: No known ITW. CISA ADP SSVC Exploitation is none (timestamp 2026-11-06T04:56:29.596160Z). The Hacker News (5 Nov 2026) covers the 46-flaw batch, names CVE-2026-68524 and CVE-2026-109928, and does not report in-the-wild use. Not in CISA KEV (catalog 2026.11.04, released 2026-11-04T20:00:05.774Z, checked 6 Nov 2026). None of CVE-2026-83542, CVE-2026-68524, or CVE-2026-73578 has a catalog row.\n\nPoC. CryptoCat published a researcher-run lab demonstration of CVE-2026-83542 only. It is lab-validated and deployment-specific, not production exploitation, and not a blanket Public PoC: RCE mark. Index link only; this site does not copy exploit code, payloads, staging details, or usage steps. It does not cover CVE-2026-68524 or CVE-2026-73578. The /pocs chip is Lab-validated (deployment-specific). The glance badge is Public PoC (lab RCE, deployment-specific).\n\nCredit: Jacopo Cappellato (Apache oss-security, 4 Nov 2026). Jonah Burgess (CryptoCat) for CVE-2026-83542 (reporter) and CVE-2026-73578 (finder); reported CVE-2026-83542 to Apache on 2 Aug 2026. Krishna Uprit (remediation developer on 83542 and 73578). David Crees, Abstract Shield (reporter on 83542). Naoya Takahashi (nakko) for CVE-2026-68524.","attackPath":{"caption":"High-level only. Not a reproduction guide. No payloads, endpoints, or usage steps. Code runs as the OFBiz service account, not necessarily root.","steps":[{"id":"reach","label":"Reachable OFBiz HTTP","detail":"An unauthenticated client can reach a vulnerable OFBiz application over HTTP or HTTPS. Auth is not required for these bugs."},{"id":"untrusted-resource","label":"Untrusted content as a trusted resource","detail":"The app may treat attacker-supplied content as a trusted screen or widget resource location."},{"id":"render","label":"Render evaluates script","detail":"Rendering that resource may evaluate attacker-supplied script inside the Java process."},{"id":"process-account","label":"Code as the OFBiz account","detail":"Execution is as the OFBiz service account. That is not a claim of root."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-04","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 6 Nov 2026) against catalog 2026.11.04 (released 2026-11-04T20:00:05.774Z). CVE-2026-83542, CVE-2026-68524, and CVE-2026-73578 have no catalog rows."},"firstSeen":{"date":null,"source":"CISA ADP SSVC on the NVD CVE-2026-83542 record (Exploitation none, timestamp 2026-11-06T04:56:29.596160Z). Apache oss-security 4 Nov 2026. The Hacker News 5 Nov 2026. CryptoCat lab demonstration of CVE-2026-83542 (lab only).","note":"No known in-the-wild use as of 7 Nov 2026. First public CVE announcement 4 Nov 2026 (oss-security). Apache and The Hacker News do not report attacks. CISA ADP SSVC Exploitation is none. CryptoCat reports a researcher-run lab demonstration of CVE-2026-83542 under deployment-specific conditions; that is not production exploitation. Badge: No known ITW."},"vendorStatements":[{"vendor":"Apache OFBiz","date":"2026-11-04","statement":"Affected versions: All versions prior to 24.09.08. Users are advised to upgrade to Apache OFBiz 24.09.08, which addresses these vulnerabilities.","url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","retracted":false},{"vendor":"Apache OFBiz","date":"2026-11-04","statement":"CVE-2026-83542: Unauthenticated RCE via login-page widget injection. CVE-2026-68524: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading. CVE-2026-73578: Unauthenticated saved-view authorization bypass with RCE impact.","url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","retracted":false}]},"timeline":[{"date":"2026-08-02","event":"CryptoCat: reported CVE-2026-83542 to the Apache OFBiz security team on 2 Aug 2026, with a follow-up the same day. Apache CNA credits Jonah Burgess (CryptoCat) as reporter.","source":{"title":"CVE-2026-83542: Apache OFBiz Unauthenticated RCE via Widget-Resource Injection","url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","publisher":"CryptoCat"},"kind":"disclosure","key":true,"addedDate":"2026-11-07"},{"date":"2026-10-21T19:53:28Z","event":"Git tag release24.09.08 created by Jacopo Cappellato (annotated tag, object a12cafc095b78fbba7978d26c6ad33dc0ce6cfae). This is the tag date, not the download.html calendar day. Apache's download page says Released in November 2026.","source":{"title":"release24.09.08 tag","url":"https://github.com/apache/ofbiz-framework/tree/release24.09.08","publisher":"Apache OFBiz"},"kind":"patch","addedDate":"2026-11-07"},{"date":"2026-11-04T16:12:59Z","event":"Jacopo Cappellato posted Apache OFBiz: CVE Announcements to oss-security (Wed, 4 Nov 2026 17:12:59 +0100). 46 CVEs. Affected: all versions prior to 24.09.08. Upgrade to 24.09.08.","source":{"title":"Apache OFBiz: CVE Announcements","url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","publisher":"oss-security"},"kind":"advisory","key":true,"addedDate":"2026-11-07"},{"date":"2026-11-05T13:59:22.695Z","event":"Apache CNA published CVE-2026-83542. Title: Unauthenticated RCE via login-page widget injection. CWE-94. Textual severity critical; no numeric CVSS from Apache.","source":{"title":"CVE-2026-83542","url":"https://www.cve.org/CVERecord?id=CVE-2026-83542","publisher":"Apache CNA"},"kind":"advisory","key":true,"addedDate":"2026-11-07"},{"date":"2026-11-05T14:10:39.024Z","event":"Apache CNA published CVE-2026-73578. Title: Unauthenticated saved-view authorization bypass with RCE impact. CWE-288. Textual severity important; no numeric CVSS.","source":{"title":"CVE-2026-73578","url":"https://www.cve.org/CVERecord?id=CVE-2026-73578","publisher":"Apache CNA"},"kind":"advisory","addedDate":"2026-11-07"},{"date":"2026-11-05T14:11:35.683Z","event":"Apache CNA published CVE-2026-68524. Title: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading. CWE-94. Textual severity important; no numeric CVSS. Credit: Naoya Takahashi (nakko).","source":{"title":"CVE-2026-68524","url":"https://www.cve.org/CVERecord?id=CVE-2026-68524","publisher":"Apache CNA"},"kind":"advisory","addedDate":"2026-11-07"},{"date":"2026-11-05T14:17:06.820Z","event":"NVD published CVE-2026-83542. GHSA-98rg-5rx4-6c7x published 2026-11-05T15:32:36Z.","source":{"title":"CVE-2026-83542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83542","publisher":"NVD"},"kind":"advisory","key":true,"addedDate":"2026-11-07"},{"date":"2026-11-05T15:17:22.090Z","event":"NVD published CVE-2026-68524. vulnStatus Received. Empty metrics. GHSA-jcx6-8pcq-frpq has no numeric score.","source":{"title":"CVE-2026-68524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68524","publisher":"NVD"},"kind":"advisory","addedDate":"2026-11-07"},{"date":"2026-11-05T15:17:22.497Z","event":"NVD published CVE-2026-73578. vulnStatus Received. Empty metrics. GHSA-8q8q-2cjc-7vh5 has no numeric score.","source":{"title":"CVE-2026-73578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73578","publisher":"NVD"},"kind":"advisory","addedDate":"2026-11-07"},{"date":"2026-11-05","event":"The Hacker News (Ravie Lakshmanan) covers the batch: 46 flaws including CVE-2026-68524 pre-auth RCE and CVE-2026-109928 account takeover, patched in 24.09.08. It does not headline CVE-2026-83542 and does not report in-the-wild use.","source":{"title":"ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories","url":"https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-11-07"},{"date":"2026-11-05T22:12:43Z","event":"projectdiscovery/nuclei-templates pull request 17709 opened by alex700: CVE-2026-68524 Apache OFBiz file URI screen detector. Open, not merged, as of 6 Nov 2026. The PR says the result demonstrates unsafe anonymous file: screen loading and does not prove remote code execution. Detection only; not indexed on /pocs.","source":{"title":"Add CVE-2026-68524 Apache OFBiz file URI screen detector","url":"https://github.com/projectdiscovery/nuclei-templates/pull/17709","publisher":"alex700"},"kind":"other","addedDate":"2026-11-07"},{"date":"2026-11-04","event":"Not in CISA KEV. Catalog 2026.11.04, released 2026-11-04T20:00:05.774Z. Rechecked 6 Nov 2026. CVE-2026-83542, CVE-2026-68524, and CVE-2026-73578 have no catalog rows.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":true,"addedDate":"2026-11-07"},{"date":"2026-11-06T04:23:40Z","event":"foxcornlab/ofbiz-scanner repository created. Local version triage against 24.09.08. Detection only; not indexed on /pocs.","source":{"title":"foxcornlab/ofbiz-scanner","url":"https://github.com/foxcornlab/ofbiz-scanner","publisher":"foxcornlab"},"kind":"other","addedDate":"2026-11-07"},{"date":"2026-11-06T12:17:22.267Z","event":"NVD lastModified CVE-2026-83542. Secondary CVSS 3.1 9.8 from CISA ADP (source 134c704f-9b21-4f2e-91b3-4a467353bcc0). SSVC Exploitation none, Automatable yes, Technical Impact total. vulnStatus Undergoing Analysis. No NVD-produced Primary.","source":{"title":"CVE-2026-83542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83542","publisher":"NVD / CISA ADP"},"kind":"other","addedDate":"2026-11-07"}],"openNotes":[{"title":"46 CVEs in 24.09.08; three pre-auth RCE-class bugs on this page","detail":"Apache announced 46 CVEs in 24.09.08. This page covers CVE-2026-83542, CVE-2026-68524, and CVE-2026-73578. Do not treat the rest of the batch as pre-auth RCE, and do not treat the CryptoCat lab demonstration as covering them.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"},{"url":"https://ofbiz.apache.org/security.html","date":"2026-11-04","publisher":"Apache OFBiz"}]},{"title":"CryptoCat lab demonstration is deployment-specific","detail":"CryptoCat published a researcher-run lab demonstration of CVE-2026-83542 only. It is lab-validated and deployment-specific, not production exploitation, and not a blanket Public PoC: RCE mark. Index link only; this site does not copy exploit code, payloads, staging details, or usage steps. It does not cover CVE-2026-68524 or CVE-2026-73578. The on-page byline date was not verified as a publish timestamp.","sources":[{"url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":null,"publisher":"CryptoCat"}]},{"title":"No numeric CVSS for CVE-2026-68524 or CVE-2026-73578","detail":"Apache published textual severity important for both, with no numeric CVSS. NVD metrics are empty (Received, 5 Nov 2026). GHSA-jcx6-8pcq-frpq and GHSA-8q8q-2cjc-7vh5 have no score. Do not infer a number from the 46-CVE batch.","sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68524","date":"2026-11-05","publisher":"NVD"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73578","date":"2026-11-05","publisher":"NVD"}]},{"title":"No GitHub Release object for 24.09.08; Nuclei detector PR is still open","detail":"https://github.com/apache/ofbiz-framework/releases/tag/release24.09.08 returned 404. The annotated git tag exists; this page links the tag tree and download.html. projectdiscovery/nuclei-templates pull request 17709 was still open, not merged, as of 6 Nov 2026.","sources":[{"url":"https://github.com/apache/ofbiz-framework/tree/release24.09.08","date":"2026-10-21","publisher":"Apache OFBiz"},{"url":"https://github.com/projectdiscovery/nuclei-templates/pull/17709","date":"2026-11-05","publisher":"alex700"}]}],"defenderActions":[{"title":"Upgrade to Apache OFBiz 24.09.08","detail":"Apache: all versions prior to 24.09.08 are affected. Upgrade to 24.09.08, which addresses the 46 CVEs in that announcement, including CVE-2026-83542, CVE-2026-68524, and CVE-2026-73578.","priority":"now","links":[{"label":"oss-security announcement","href":"https://www.openwall.com/lists/oss-security/2026/11/04/9"},{"label":"Apache OFBiz downloads","href":"https://ofbiz.apache.org/download.html"}]},{"title":"Restrict exposure and admin access until patched","detail":"Until 24.09.08 is installed, limit who can reach OFBiz HTTP and administrative applications. Network limits are a workaround, not a software fix. Still upgrade.","priority":"now","links":[{"label":"Apache OFBiz security","href":"https://ofbiz.apache.org/security.html"}]},{"title":"Review non-default security.allowFilePaths values","detail":"CryptoCat on the 24.09.08 default: an empty security.allowFilePaths rejects every non-component location. Leave it empty unless OFBiz must load widget resources from outside a component. A permissive value widens the loader's filesystem trust. This is CryptoCat's description of the shipped default, not an Apache wiki workaround.","priority":"now","links":[{"label":"CryptoCat CVE-2026-83542 analysis","href":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/"}]},{"title":"Network or proxy behaviour is not a software fix","detail":"CryptoCat's lab method is deployment-specific; network or proxy behaviour is not a software fix. Still upgrade to 24.09.08.","priority":"now","links":[{"label":"CryptoCat CVE-2026-83542 analysis","href":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/"}]}],"detection":[{"title":"Anomalous anonymous requests to public OFBiz screens","detail":"Hunt unexpected unauthenticated requests to public OFBiz application screens. A hit is a behavioural lead for exposure or probing, not proof of code execution, and not a signature or IOC.","logSource":"HTTP access logs (OFBiz listener or reverse proxy)","kind":"generic","group":"web-proxy","url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-07","dateKind":"checked","described":true},{"title":"Unexpected external resource loading or widget parse errors","detail":"Hunt OFBiz application logs for unexpected external resource loading, or screen or widget parse or script-evaluation errors. A hit is a behavioural lead, not proof of RCE, and not a signature or IOC.","logSource":"OFBiz application logs","kind":"generic","url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":"2026-11-07","dateKind":"checked","described":true},{"title":"Unexpected child processes or file writes by the OFBiz account","detail":"Hunt unexpected child processes or file writes by the OFBiz service account. Execution, if it occurs, is as that account, not necessarily root. A hit is a behavioural lead, not proof of these CVEs, and not a signature or IOC.","logSource":"EDR or host process and file telemetry","kind":"generic","group":"edr","url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":"2026-11-07","dateKind":"checked","described":true},{"title":"foxcornlab local OFBiz version scanner","detail":"Local version triage against 24.09.08. Detection only. Not a PoC and not indexed on /pocs. A version match does not establish exploitation.","logSource":"Local OFBiz version inventory","kind":"generic","url":"https://github.com/foxcornlab/ofbiz-scanner","date":"2026-11-06"},{"title":"Nuclei detector PR for CVE-2026-68524 (open, not merged)","detail":"projectdiscovery/nuclei-templates pull request 17709, opened 5 Nov 2026 by alex700, still open and not merged as of 6 Nov 2026. The PR says the result demonstrates unsafe anonymous file: screen loading, a part of the reported CVE chain, and does not prove remote code execution. Detection only. Not indexed on /pocs. Unsafe-location detection does not establish full RCE.","logSource":"Nuclei detector output (PR 17709, not merged)","kind":"generic","url":"https://github.com/projectdiscovery/nuclei-templates/pull/17709","date":"2026-11-05"}],"detectionRules":[],"detectionLinks":[{"title":"Add CVE-2026-68524 Apache OFBiz file URI screen detector","url":"https://github.com/projectdiscovery/nuclei-templates/pull/17709","author":"alex700","date":"2026-11-05","note":"Open, not merged, as of 6 Nov 2026. The PR says unsafe anonymous file: screen loading does not prove remote code execution. Detection only. This site does not copy requests or payloads. Not indexed on /pocs."},{"title":"foxcornlab/ofbiz-scanner","url":"https://github.com/foxcornlab/ofbiz-scanner","author":"Vineeth Kumar / foxcornlab","date":"2026-11-06","note":"Local version triage against 24.09.08. Detection only. Not indexed on /pocs. This site does not copy extra scores from that README."}],"amIAffected":{"summary":"Apache OFBiz before 24.09.08 is in scope. Inventory the installed version and who can reach the HTTP listener. Do not send a test request that tries to load a screen or widget resource.","checks":[{"id":"v2s-aia-apache-ofbiz-preauth-rce-cve-2026-83542-version-1","kind":"version","title":"Record the installed OFBiz version","detail":"Apache: all versions prior to 24.09.08 are affected. Record the version from the running install (VERSION file, package metadata, or git describe --tags). This is inventory only. Do not send a crafted request.","command":"Record the installed Apache OFBiz version from the VERSION file, package metadata, or git describe --tags, then compare it to 24.09.08.","affectedMeans":"The recorded version is prior to 24.09.08.","fixedMeans":"The recorded version is 24.09.08 or later, or OFBiz is not installed.","notes":"download.html says 24.09.08 was released in November 2026. The git tag release24.09.08 is dated 21 Oct 2026. Do not collapse those dates.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"},{"url":"https://ofbiz.apache.org/download.html","date":null,"publisher":"Apache OFBiz"}]},{"id":"v2s-aia-apache-ofbiz-preauth-rce-cve-2026-83542-config-1","kind":"config","title":"Record who can reach OFBiz HTTP","detail":"These bugs need no login. Record whether networks other than trusted admin networks can complete a connection to the OFBiz HTTP or HTTPS listener, including any reverse proxy in front of it. Do not authenticate or submit a test body.","command":"Record the listener addresses, reverse-proxy ACLs, and edge rules that govern OFBiz HTTP or HTTPS, and whether any non-admin network can complete a connection.","affectedMeans":"OFBiz is prior to 24.09.08 and the HTTP listener is reachable from a network that is not a trusted admin network.","fixedMeans":"Only trusted admin networks can reach OFBiz HTTP (workaround), or 24.09.08 is installed.","notes":"Network limits are a workaround, not a software fix. Still upgrade. No sourced Shodan or Censys fingerprint. Do not invent a banner.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"}]},{"id":"v2s-aia-apache-ofbiz-preauth-rce-cve-2026-83542-config-2","kind":"config","title":"Record security.allowFilePaths","detail":"CryptoCat on 24.09.08: an empty security.allowFilePaths rejects every non-component location. Record whether that property is empty or set to a non-default pattern. Do not use a crafted location as a test.","command":"Record the security.allowFilePaths value from the running OFBiz security configuration, or that it is empty.","affectedMeans":"24.09.08 is installed and security.allowFilePaths is set to a permissive non-default pattern that allows non-component locations.","fixedMeans":"security.allowFilePaths is empty (24.09.08 default-deny), or OFBiz is not installed.","notes":"A permissive value widens filesystem trust. The 24.09.08 file-scheme rejection and JSON shadowing fix still block the 83542 chain, per CryptoCat. This is not a substitute for upgrading.","sources":[{"url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":null,"publisher":"CryptoCat"}]}],"limits":["No sourced Shodan or Censys fingerprint. Do not invent a port or banner.","Do not send a crafted screen, widget, or JSON body as a test.","Commercial forks and embedded deployments have no vendor statement yet.","CryptoCat's lab method is deployment-specific; network or proxy behaviour is not a software fix."],"sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"},{"url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":null,"publisher":"CryptoCat"}],"updatedAt":"2026-11-07","addedDate":"2026-11-07"},"mitigations":{"summary":"Apache published no workaround besides upgrading to 24.09.08. Restricting exposure is an operational step on this page, not a vendor-published mitigation. CryptoCat (not Apache) describes reviewing security.allowFilePaths and says the lab method is deployment-specific; network or proxy behaviour is not a software fix.","items":[],"nonePublished":{"statement":"No vendor mitigation published; patch is the only fix","checkedDate":"2026-11-06","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"},{"url":"https://ofbiz.apache.org/security.html","date":"2026-11-04","publisher":"Apache OFBiz"}]},"updatedAt":"2026-11-07","addedDate":"2026-11-07"},"response":{"summary":"If OFBiz HTTP was reachable while prior to 24.09.08, treat it as exposed. Upgrade to 24.09.08, restrict exposure, and review access logs, application logs, and host telemetry from that window. No sourced persistence paths or IOCs were published. This is not a claim of in-the-wild use.","containment":[{"title":"Upgrade to Apache OFBiz 24.09.08","detail":"Apache: users are advised to upgrade to 24.09.08.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"}]},{"title":"Restrict OFBiz HTTP to trusted networks","detail":"Until the upgrade is confirmed, limit who can reach the listener. Network limits are not a software fix.","sources":[{"url":"https://ofbiz.apache.org/security.html","date":"2026-11-04","publisher":"Apache OFBiz"}]},{"title":"Review access logs, application logs, and host telemetry","detail":"Hunt anomalous anonymous requests to public screens, unexpected external resource loading or widget parse errors, and unexpected child processes or file writes by the OFBiz account. A hit is a lead, not proof.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"},{"url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":null,"publisher":"CryptoCat"}]}],"rotate":[{"item":"OFBiz service-account credentials and secrets readable by that account","reason":"If code ran, it ran as the OFBiz service account, including access to that process's credentials and network position (CryptoCat). Rotate those secrets on hosts that were reachable while unpatched. Generic IR; Apache did not publish a credential list.","generic":true,"sources":[{"url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":null,"publisher":"CryptoCat"}]}],"evidence":[{"title":"Installed OFBiz version from before the upgrade","detail":"Keep VERSION, package, or git-describe output so you can show whether the install was prior to 24.09.08.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"}]},{"title":"HTTP access logs covering public OFBiz screens","detail":"Keep reverse-proxy or listener logs from the exposure window. A hit is a lead, not proof.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"}]},{"title":"OFBiz application logs and EDR or host telemetry for the OFBiz account","detail":"Keep unexpected resource-loading or script-evaluation errors, and unexpected child processes or file writes. No sourced persistence path was published.","generic":true,"sources":[{"url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":null,"publisher":"CryptoCat"}]}],"limits":["No sourced persistence paths or IOCs were published.","No known in-the-wild use as of 7 Nov 2026.","CryptoCat lab demonstration is deployment-specific and is not production exploitation.","Unsafe-location detection does not establish full RCE."],"sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","publisher":"oss-security"},{"url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":null,"publisher":"CryptoCat"}],"updatedAt":"2026-11-07","addedDate":"2026-11-07"},"bulletins":[],"coverage":[{"title":"Apache OFBiz security advisories","publisher":"Apache OFBiz","url":"https://ofbiz.apache.org/security.html","date":"2026-11-04","type":"vendor","addedDate":"2026-11-07"},{"title":"Apache OFBiz: CVE Announcements","publisher":"oss-security / Jacopo Cappellato","url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","date":"2026-11-04","type":"vendor","addedDate":"2026-11-07"},{"title":"Download Apache OFBiz","publisher":"Apache OFBiz","url":"https://ofbiz.apache.org/download.html","date":null,"type":"vendor","addedDate":"2026-11-07"},{"title":"CVE-2026-83542","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83542","date":"2026-11-05","type":"government","addedDate":"2026-11-07"},{"title":"GHSA-98rg-5rx4-6c7x","publisher":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-98rg-5rx4-6c7x","date":"2026-11-05","type":"vendor","addedDate":"2026-11-07"},{"title":"CVE-2026-68524","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68524","date":"2026-11-05","type":"government","addedDate":"2026-11-07"},{"title":"GHSA-jcx6-8pcq-frpq","publisher":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-jcx6-8pcq-frpq","date":"2026-11-05","type":"vendor","addedDate":"2026-11-07"},{"title":"CVE-2026-73578","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73578","date":"2026-11-05","type":"government","addedDate":"2026-11-07"},{"title":"GHSA-8q8q-2cjc-7vh5","publisher":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-8q8q-2cjc-7vh5","date":"2026-11-05","type":"vendor","addedDate":"2026-11-07"},{"title":"ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html","date":"2026-11-05","type":"news","addedDate":"2026-11-07"},{"title":"CVE-2026-83542: Apache OFBiz Unauthenticated RCE via Widget-Resource Injection","publisher":"CryptoCat","url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","date":null,"type":"research","addedDate":"2026-11-07"},{"title":"CISA KEV catalog JSON (CVE-2026-83542, CVE-2026-68524, and CVE-2026-73578 not listed; catalog 2026.11.04)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-04","type":"government","addedDate":"2026-11-07"}],"posts":[],"research":[{"title":"CVE-2026-83542: Apache OFBiz Unauthenticated RCE via Widget-Resource Injection","url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","authors":"CryptoCat (Jonah Burgess)","date":null},{"title":"CVE-2026-73578 analysis","url":"https://cryptocat.me/blog/research/analysis/cve_2026_73578/","authors":"CryptoCat (Jonah Burgess)","date":null}],"impact":{"kind":"single-product","product":"Apache OFBiz","versions":[{"version":"Apache OFBiz before 24.09.08","status":"affected","versions":"24.09.08","vendorStatement":{"date":"2026-11-04","url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","quote":"Affected versions: All versions prior to 24.09.08. Users are advised to upgrade to Apache OFBiz 24.09.08, which addresses these vulnerabilities."},"addedDate":"2026-11-07"},{"version":"Commercial forks and embedded OFBiz deployments","status":"no-statement-yet","addedDate":"2026-11-07"}]},"pocs":[{"title":"CryptoCat lab demonstration of CVE-2026-83542 (for defenders)","url":"https://cryptocat.me/blog/research/analysis/cve_2026_83542/","source":"CryptoCat","validationStatus":"validated","validationDate":null,"listedDate":"2026-11-07","notes":"Listed for defenders. CryptoCat published a researcher-run lab demonstration of CVE-2026-83542 only. It is lab-validated and deployment-specific, not production exploitation, and not a blanket Public PoC: RCE mark. Independent lab demonstration, not a vuln2shell validation. Index link only; this site does not copy exploit code, payloads, staging details, or usage steps. It does not cover CVE-2026-68524 or CVE-2026-73578. The on-page byline date was not verified as a publish timestamp.","addedDate":"2026-11-07","kind":"lab-rce-deployment-specific"}],"_feed":{"page":"https://vuln2shell.com/vulns/apache-ofbiz-preauth-rce-cve-2026-83542","json":"https://vuln2shell.com/vulns/apache-ofbiz-preauth-rce-cve-2026-83542.json","iocsCsv":"https://vuln2shell.com/vulns/apache-ofbiz-preauth-rce-cve-2026-83542/iocs.csv","stix":"https://vuln2shell.com/vulns/apache-ofbiz-preauth-rce-cve-2026-83542/stix.json","badges":{"patch":"Patched","itw":"No known ITW","poc":"Public PoC (lab RCE, deployment-specific)"}}}