What is CVE-2026-81815?
SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g. _ic=Y) with a crafted value, causing SqlJdbcUtil.addValueSingle to inline the EntityFunction-wrapped value directly into the SQL text using ANSI-only single-quote doubling instead of binding it as a parameter, which is insufficient on MySQL/MariaDB because those dialects also honor backslash escapes, letting a backslash-terminated payload break out of the string literal and turn the WHERE clause into a tautology. The default Derby datasource and PostgreSQL are not affected because they do not interpret backslash as an escape character in this context. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
The record classifies CVE-2026-81815 under weakness class CWE-89. 1 affected-product entry is recorded, across 1 vendor, listed below.
Severity and exploitation probability
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- 2026-11-05
Is CVE-2026-81815 being exploited?
It currently carries a trending score of 5 in the Threadlinqs vulnerability feed.
Affected products and versions
- Apache Software Foundation: Apache OFBiz
How to fix CVE-2026-81815
Vendor advisory: https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-81815
1 tracked threat in the Threadlinqs corpus references CVE-2026-81815, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Enriched from CVE.org, NVD. Last verified by Threadlinqs on . This product uses the NVD API but is not endorsed or certified by the NVD.