Threat reportVulnerabilityTL-2026-1898
Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz 24.09.05 (CVE-2026-31986)
Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz (TL-2026-1898), also tracked as Novee Pre-auth RCE Java Middleware, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-08-05 and last reviewed 2026-08-09. It has no confirmed attribution, affects Apache Software Foundation OFBiz, references 4 CVEs (CVE-2026-31986, CVE-2022-25237, CVE-2026-45434), maps to 20 MITRE ATT&CK techniques (T1027, T1027.010, T1036), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 20MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-1898
- Threat ID
- TL-2026-1898
- Also known as
- Novee Pre-auth RCE Java Middleware
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise, technology, finance, government administration, health, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
- Updates
- 2026-08-09 · revalidated 1× · latest source
How Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz works
Novee researchers demonstrated two pre-authentication remote code execution chains at Black Hat USA 2026: a path-traversal + XStream deserialization chain in Bonita BPM 10.4.3 bypassing the public API surface into the internal API, and a forged-SSO-token chain in Apache OFBiz 24.09.05 using publicly-shipped signing keys to reach Groovy evaluation. Both vendors released fixes within the standard 90-day disclosure timeline.
At Black Hat USA 2026 (August 5, 2026), Novee Security researchers Lidor Ben Shitrit and Assaf Levkovich presented two pre-authentication remote code execution chains targeting widely-deployed enterprise Java platforms: Bonita BPM (Bonitasoft) and Apache OFBiz. The talk, titled 'Pre-auth RCE in Enterprise Java: When Middleware Becomes the Exploit,' exposed how trusted enterprise middleware layers that were never designed to process untrusted input can become reliable RCE paths. Novee's broader research yielded 12 vulnerabilities across four enterprise Java platforms, including a sandbox escape, with these two chains representing the most impactful findings.
The Bonita BPM 10.4.3 chain exploits a parsing differential between Bonita's security filters and the underlying Apache Tomcat servlet container to collapse three independent security boundary checks via a single crafted URL. (1) Path traversal via the `..;` sequence: Bonita's security filter interprets the segment as a benign path component, while Tomcat strips the semicolon as a matrix parameter delimiter and treats the remainder as a directory traversal, routing the request to the internal API surface. (2) Substring-based filter matching: a fabricated application name embedded in the path satisfies both Bonita's authentication filter and CSRF token guard simultaneously, as both filters stop reading at the substring they matched. (3) Incomplete forward protection: one request type is protected against direct external access but forwarded requests bypass that protection entirely. The result is a single unauthenticated POST request that reaches Bonita's internal API endpoint, which feeds attacker-supplied XML directly into XStream deserialization. The XStream payload constructs a Commons Collections gadget chain that routes through a memory shortcut bypassing standard safety checks, culminating in a Groovy call that executes arbitrary OS commands. The entire sequence executes inside a single XStream call before the request finishes. These vulnerabilities were tracked internally by Bonitasoft as CVE-233 (path traversal/authentication bypass via semicolon parsing differential), CVE-234 (pre-authentication RCE via XStream deserialization), and CVE-235 (pre-authentication SSRF via ObjectInputStream deserialization). They were fixed in Bonita 2025.2-u5 (released February 26, 2026). Bonita version 10.4.3 maps to 2025.2-u3, which predates the fix and is therefore vulnerable.
The Apache OFBiz 24.09.05 chain (assigned CVE-2026-31986, CVSS 9.1 Critical) exploits two architectural weaknesses in sequence. First, a hard-coded cryptographic key (CWE-321) used for JWT token signing. OFBiz ships a 64-character HMAC512 signing key in its public source repository at `framework/security/config/security.properties`: the value `%D*G-JaNdRgUkXp2s5v8y/B?E(H+MbPeShVmYq3t6w9z$C&F)J@NcRfTjWnZr4u7`. Every installation retaining the default configuration signs tokens with a secret that anyone can read from the open-source repository. An attacker forges a JWT with the admin claim, which OFBiz fully trusts, granting admin-level session access. Second, the same key also signs the widget engine's callback tokens. A token field names a screen area to render; OFBiz reads that field and pipes it into a FreeMarker template expander that evaluates embedded `${groovy:...}` scriptlets. An accessibility preference flag determines whether Groovy evaluation is enabled, and only an administrator can flip it. The forged admin session flips this flag, then sends a token with a malicious Groovy command replacing the screen name. OFBiz's denylist blocks script injection by matching lowercase text and known prefixes, but two bypasses exist: a capital-P `ProcessBuilder` slips past, and an auto-imported Java class requiring no prefix also bypasses the denylist. The attack requires only two unauthenticated GET requests to achieve full remote code execution on any OFBiz installation with single sign-on enabled. The CISA-ADP SSVC assessment rates exploitation as currently 'none' (no known in-the-wild exploitation), but 'automatable' (yes) and 'technical impact' (total). Other CVEs fixed in OFBiz 24.09.06 include CVE-2026-46586 (Groovy eval injection in traverseContent, CVSS 8.8) and CVE-2026-45434 (authentication bypass via password-change logic flaw, CVSS 9.8).
HelpNetSecurity identified five repeating enterprise Java security weak spots across Novee's findings: (1) web configuration protects direct requests but passes forwarded ones (Bonita forward bypass); (2) filter matching on substrings (Bonita auth/CSRF filters); (3) a single signing key authorizing separate features (OFBiz SSO + widget tokens); (4) denylist guarding script evaluation (OFBiz Groovy filter); and (5) a preference flag gating dangerous code (OFBiz accessibility toggle). The researchers emphasized that these vulnerabilities evade signature-based scanners because each component appears benign in isolation—a stray URL segment, a default key, a missing case flag on a regex—the exploit lives in how the pieces connect. Novee's research methodology was predominantly human-led, with targeted assistance from their offensive AI agent; findings from this work feed back into their model tuning.
MITRE ATT&CK techniques used in TL-2026-1898
Defense Evasion
T1027 Obfuscated Files or Information; T1027.010 Obfuscated Files or Information; T1036 Masquerading; T1211 Exploitation for Defense Evasion; T1562 Impair Defenses
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery
Credential Access
T1552 Unsecured Credentials; T1552.001 Unsecured Credentials; T1606 Forge Web Credentials
Resource Development
T1588.002 Obtain Capability; T1588.005 Obtain Capability; T1588.006 Obtain Capability
defense-impairment
Affected products and versions in Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz
- Apache Software Foundation — OFBiz
Vulnerable versions: All versions before 24.09.06
Fixed in: 24.09.06 - Bonitasoft — Bonita BPM
Vulnerable versions: 10.4.3 (2025.2-u3) and earlier
Fixed in: 2025.2-u5 (2026-02-26)
Remediation for Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz
Patches
- Apache OFBiz: upgrade to 24.09.06 (released May 2026)
- Bonita BPM: upgrade to 2025.2-u5 (released February 26, 2026) or later
Immediate actions
- Upgrade Apache OFBiz to version 24.09.06 or later immediately
- Upgrade Bonita BPM to 2025.2-u5 or later (10.4.3 is vulnerable)
- For OFBiz: replace all hardcoded JWT signing keys by running ./gradlew generateSecretKeys after upgrading
- Deploy WAF rules to detect anomalous JWT structures and FreeMarker/Groovy injection patterns (<#assign, ${...})
- Block access to /webtools/control/ProgramExport and traverseContent endpoints at network perimeter
Workarounds
- Disable SSO/JWT authentication on OFBiz if not in use
- Change all default demo accounts (admin, flexadmin, demoadmin all use password 'ofbiz')
- Enable useDeniedScriptletsTokens=true in framework/security/config/security.properties
- Restrict network access to Bonita BPM internal API endpoints
- Manually set a unique 64-character security.token.key in OFBiz security.properties if immediate upgrade is not possible
Longer-term hardening
- Harden internal routing as though it sits on the internet
- Remove unsafe execution primitives entirely from middleware layers
- Audit path normalization discrepancies between security filters and servlet containers (Tomcat/Jetty)
- Replace substring-based filter matching with exact path matching
- Never let a rendering toggle gate a call to eval() or script interpreter
- Audit shared cryptographic signing keys across separate features within the same application
CVEs associated with Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz
CVE-2026-31986, CVE-2022-25237, CVE-2026-45434, CVE-2026-46586
Weaknesses (CWE) in Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz
Timeline of Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz
- Apache OFBiz 24.09.05 released, still vulnerable to CVE-2026-31986 (fixed in subsequent .06 release)
- Bonita BPM 10.4.3 (2025.2-u3) released, still vulnerable to CVE-233/234/235 (fixed in subsequent u5)
- Bonitasoft released 2025.2-u5 fixing CVE-233 (path traversal/auth bypass), CVE-234 (pre-auth XStream RCE), and CVE-235 (pre-auth ObjectInputStream SSRF)
- Apache OFBiz released version 24.09.06 fixing CVE-2026-31986 (hardcoded JWT signing key), along with CVE-2026-46586 and CVE-2026-45434; fix commit 6ba1356 removes default keys and adds generateSecretKeys Gradle task
- Apache OFBiz CVE-2026-31986 publicly disclosed via OSS-security mailing list and Apache advisory; CISA-ADP assigned CVSS 9.1
- CISA-ADP completed SSVC assessment for CVE-2026-31986: no active exploitation, automatable, technical impact total
- Novee published press release announcing four sessions at Black Hat USA and DEF CON 2026, including 'Pre-auth RCE in Enterprise Java: When Middleware Becomes the Exploit'
- HelpNetSecurity published technical article detailing the Bonita BPM and Apache OFBiz chains, identifying five common enterprise Java weak spots
- Lidor Ben Shitrit and Assaf Levkovich of Novee Security presented both pre-auth RCE chains at Black Hat USA 2026, 11:05-11:45 a.m., Oceanside D
- GBHackers on Security publishes coverage of the disclosure, corroborating the Black Hat presentation and Help Net Security reporting and naming the two chains 'BadBonita' and 'SSOnOf(a)biz'.
Update history for TL-2026-1898
- 2026-08-09 — Pre-Auth RCE Chains in Bonita BPM (BadBonita) and Apache OFBiz (SSOnOf(a)biz, CVE-2026-31986): What changed No escalation to severity, exploitability, CVSS, or attribution — both vendor fixes were already reflected in the existing record. The new report is corroborating follow-on coverage of the same disclosure. New indicators (3) 3
Sources cited for Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz
- Pre-auth RCE in Java Bonita, OFBiz (CVE-2026-31986)
- NVD Detail for CVE-2026-31986
- Apache OFBiz Security Page
- OSS-Security Disclosure: CVE-2026-31986
- Apache OFBiz Release Notes 24.09.06
- Novee Researchers to Present Four Sessions at Black Hat USA and DEF CON 2026
- Bonita 2025.2 Release Notes (Security Fixes)
- CISA-ADP SSVC Assessment for CVE-2026-31986
- Apache OFBiz CVE-2026-46586 Groovy Eval Injection (GitHub PoC)
- CVE-2026-31986 Fix Commit (GitHub)
- Black Hat USA 2026 Briefings Schedule
- Novee Security Blog: Black Hat 2026 Briefings
- PlanetJon Analysis: CVE-2026-45434 Auth Bypass and RCE Chain in Apache OFBiz
- GitHub Advisory: GHSA-xj47-w234-57fj
Detection coverage for TL-2026-1898
As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1898 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.