Rule Docs 1:64685

Snort • June 1, 2026

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

SERVER-WEBAPP Apache OFBiz remote code execution attempt

This rule detects an attempted remote code execution attack against vulnerable versions of Apache OFBiz by looking for calls to the unauthenticated `/webtools/control/forgotPassword` URI followed by a sub-directory, leading to controller and view map fragmentation.

This rule detects an attempted remote code execution attack against vulnerable versions of Apache OFBiz.

No public information

No known false positives

Cisco Talos Intelligence Group

MITRE::ATT&CK Framework::Enterprise::Initial Access::Exploit Public-Facing Application

Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services.

Rule Categories::Server::Web Applications

Rules for detecting attacks against miscellaneous Web applications

Vulnerability::Severity::High

Rules that cover vulnerabilities that have CVSS scores of 7.0-9.9 (CVSS V2.0) or 7.0-8.9 (CVSS V3.0 ).

Vulnerability::Severity::Critical

Rules that cover vulnerabilities that have CVSS scores of 10 (CVSS V2.0) or 9.0-10.0 (CVSS V3.0 ).

Authentication Bypass

An Authentication Bypass occurs when there is a way to avoid providing user credentials to a system before performing restricted operations on said system.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Remote Code Execution Vulnerabilities in Apache ActiveMQ and OFBiz Detected On June 1 and 2, 2026, Snort published alerts for remote code execution attempts targeting Apache ActiveMQ and Apache OFBiz. The ActiveMQ vulnerability involves insecure deserialization, allowing attackers to execute arbitrary commands via malicious Java classes. The OFBiz vulnerability exploits an unauthenticated URI, leading to potential remote code execution. Both vulnerabilities are categorized as high severity, with no known false positives reported. The attacks are aimed at web-based applications hosted on servers, highlighting the ongoing threat to public-facing applications. Security professionals are advised to monitor for these specific attack vectors and implement necessary defenses. Current status indicates active exploitation attempts in the wild. 4 sources 63

Extracted Entities

Rule Docs 1:64685

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)