Apache OFBiz RCE Flaw Abuses Password

Gbhackers •Divya • May 21, 2026

A critical authentication bypass vulnerability in Apache OFBiz allows attackers to hijack forced password-change flows and achieve remote code execution (RCE) via a single HTTP request, affecting all versions before 24.09.06. Apache OFBiz RCE Flaw Apache OFBiz is an open-source Enterprise Resource Planning (ERP) platform used for managing business processes. When an administrator flags a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities Discovered in Apache OFBiz Affecting All Versions Pre-24.09.06 Apache OFBiz has critical vulnerabilities that allow attackers to exploit hardcoded keys and bypass authentication. The vulnerabilities, CVE-2026-31986 and CVE-2026-45434, were published on 2026-05-19 and affect all versions prior to 24.09.06. Attackers can gain unauthorized access and execute remote code through a single HTTP request. The vulnerabilities are particularly dangerous due to the potential for remote code execution. Administrators are urged to upgrade to version 24.09.06 to mitigate risks. As of now, there are no confirmed attacks exploiting these vulnerabilities. Apache OFBiz is widely used for managing business processes, making the impact significant for organizations relying on this software. 3 sources 72

Extracted Entities

Apache OFBiz RCE Flaw Abuses Password

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)