Skip to navigation

Threat reportVulnerabilityTL-2026-5328

Apache OFBiz Pre-Auth RCE (CVE-2026-68524) and Account Takeover (CVE-2026-109928) Patched in 24.09.08

criticalPATCHED

Apache OFBiz 24.09.08 fixes a large batch of security issues (46 per The Hacker News, 47 per the oss-security announcement), including CVE-2026-68524 (pre-authentication RCE via an attacker-controlled Screen definition) and CVE-2026-109928 (account takeover via incorrect authentication algorithm in password-reset/login JWT validation).

Key facts for Apache OFBiz pre-auth RCE

IdentifiersTL-2026-5328, CVE-2026-68524, CVE-2026-109928, CVE-2026-73578, CVE-2026-92887, CVE-2026-105330, CVE-2026-82912, CVE-2026-81815, CVE-2026-81816
SeverityCRITICAL
First disclosed
Exploitation statusNo known exploitation
Affected productsApache Software Foundation Apache OFBiz
Weaknesses (CWE)CWE-94, CWE-303, CWE-288, CWE-306, CWE-1188, CWE-321, CWE-917
ToolsFlexibleStringExpander
MITRE ATT&CK techniquesT1059 Command and Scripting Interpreter, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1606 Forge Web Credentials
MotivationUNKNOWN
Target sectorsmanufacturing, retail, technology, logistics
Target regionsGlobal
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage for Apache OFBiz pre-auth RCE

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5328 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Apache OFBiz Java Process Spawning Shell or Interpreter

Detects the OFBiz Java process spawning a shell or scripting interpreter. This is the main post-exploitation signal for every OFBiz RCE path fixed in 24.09.08 (CVE-2026-68524, CVE-2026-73578, CVE-2026-82912), because a healthy OFBiz process does not launch sh, bash, python, cmd or PowerShell.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1059, T1059.004, T1190
  • Data sources: sysmon_for_linux, sysmon_windows, microsoft_defender_for_endpoint
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon (sourcetype="sysmon:linux" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") EventCode=1 earliest=-24h ```TL-2026-5328 OFBiz Java parent spawning shell - post-exploitation of CVE-2026-68524, CVE-2026-73578 and CVE-2026-82912```
| search ParentImage="*java*" ParentCommandLine="*ofbiz*"
| search Image IN ("*/sh", "*/bash", "*/dash", "*/zsh", "*/python*", "*/perl", "*cmd.exe", "*powershell.exe", "*pwsh.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as user by host, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("java", "java.exe", "javaw.exe")
| where InitiatingProcessCommandLine has "ofbiz"
| where FileName in~ ("sh", "bash", "dash", "zsh", "python", "python3", "perl", "cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: Apache OFBiz Java Process Spawning Shell or Interpreter
id: 2f9d4b8a-61c3-4e57-8b0a-9e3f7a1c5d02
status: experimental
description: Detects a Java process running Apache OFBiz that spawns a shell or scripting interpreter, the post-exploitation indicator for the OFBiz RCE flaws fixed in 24.09.08 (CVE-2026-68524, CVE-2026-73578, CVE-2026-82912).
references:
  - https://www.openwall.com/lists/oss-security/2026/11/04/9
  - https://ofbiz.apache.org/security.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.004
  - attack.initial-access
  - attack.t1190
  - cve.2026.68524
  - cve.2026.82912
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '\java.exe'
      - '\javaw.exe'
    ParentCommandLine|contains: 'ofbiz'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Administrator-written OFBiz start or maintenance scripts that shell out from the Java process
  - Custom OFBiz services that intentionally invoke an OS script
level: high

Known false positives:

  • Custom OFBiz services or admin scripts that intentionally exec an OS shell
  • Build or deployment tooling that starts OFBiz from a wrapper shell and is parsed as a child of the java process

Tuning notes: Baseline the OFBiz hosts for a week and allow-list known CommandLine values such as backup or print scripts. Make sure Sysmon for Linux or EDR process telemetry is deployed on every OFBiz server. Raise severity if the child runs as the OFBiz service account and has a network-facing command line.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Apache OFBiz Token-Based Login Without Interactive Login (CVE-2026-109928 / CVE-2026-105330) · unlock with TL Creds
  • Apache OFBiz Java Process Writing Web Content or Payload Files · unlock with TL Creds
  • Apache OFBiz Java Process Outbound Connection to Public IP on Unusual Port · unlock with TL Creds
  • Apache OFBiz Expression Injection in bodyText or subject Parameter (CVE-2026-82912) · unlock with TL Creds
  • Apache OFBiz Child Process Establishing Persistence (Cron, Account Creation, SSH Keys, Scheduled Task) · unlock with TL Creds
  • Apache OFBiz Child Process Running Lateral Movement or Tunneling Tools · unlock with TL Creds
  • Apache OFBiz Exploitation Request - file: URI and _LAST_VIEW_NAME_ Abuse (CVE-2026-68524 / CVE-2026-73578) · unlock with TL Creds
  • Apache OFBiz Child Process Downloader or Reverse Shell Command · unlock with TL Creds

Indicators of compromise for Apache OFBiz pre-auth RCE

As of 2026-11-05, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5328.

5 indicators of compromise · unlock with TL Creds. Compare plans

How Apache OFBiz pre-auth RCE works

Sources do not report in-the-wild exploitation or assign CVSS scores.

On 2026-11-04 Apache OFBiz maintainer Jacopo Cappellato announced on oss-security that OFBiz 24.09.08 addresses a large set of vulnerabilities affecting all versions prior to 24.09.08. The Hacker News ThreatsDay bulletin of 2026-11-05 counts 46 flaws; the oss-security message lists 47 CVEs and the Apache security page lists 33 CVEs for this release, so the exact count differs between sources. All CVE records were published on 2026-11-05 with a vendor severity of 'important' and no CVSS score.

CVE-2026-68524 (CWE-94, reported by Naoya Takahashi / nakko) is a pre-authentication remote code execution flaw: an unauthenticated attacker can abuse temporary-file handling, reach an open file descriptor, and inject a 'file:' URI so that OFBiz loads an attacker-controlled Screen definition. Fixes are tracked in upstream pull requests #1528 and #1654.

CVE-2026-109928 (CWE-303, reported by CyberLeo) is an incorrect implementation of the authentication algorithm in the password-reset and login JWT validation in OFBiz 24.09 before 24.09.08. An attacker holding a password-reset token can authenticate directly through the login endpoint, bypassing the intended password-change flow and gaining full session access, potentially with administrative privileges.

The same release fixes further authentication and code-execution flaws that chain naturally with the headline issues: CVE-2026-73578 (CWE-288, missing authorization in RequestHandler.renderView; a crafted _LAST_VIEW_NAME_ parameter persists in anonymous sessions and bypasses authentication, with RCE impact per the advisory), CVE-2026-92887 (CWE-306/CWE-1188, REST operations callable unauthenticated when the auth attribute is omitted from .rest.xml because the parser defaults to false), CVE-2026-105330 (CWE-321, hard-coded factory-default JWT security token key lets unauthenticated attackers forge admin JWTs on 24.09.06 and 24.09.07 deployments that upgraded while retaining pre-existing security configuration with SSO enabled), and CVE-2026-82912 (CWE-917, expression-language injection in EmailServices 'Send Per Email invoice' form; bodyText/subject are processed through FlexibleStringExpander without Groovy sandboxing, allowing a low-privileged authenticated user to run OS commands). The advisory also lists SQL injection in performFind ignore-case values on MySQL/MariaDB (CVE-2026-81815) and XXE (CVE-2026-81816), plus authorization bypasses, path traversals, CSRF and disclosure flaws.

Exploitation status: none of the sources states exploitation in the wild, a public PoC, or threat actor attribution; the CISA KEV catalog was only partially inspected and no OFBiz entries were seen in the portion read. Because the fixes were published publicly on 2026-11-05 with commit/PR references, patch diffing is feasible and defenders should treat exposed OFBiz instances as high priority. No network IOCs were published, so no BeaconBeagle correlation was applicable.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Credential Access

T1606 Forge Web Credentials

Remediation for Apache OFBiz pre-auth RCE

Patches

  • Apache OFBiz 24.09.08

Immediate actions

  • Upgrade all Apache OFBiz instances to 24.09.08 or later
  • Restrict internet exposure of OFBiz web and REST endpoints until patched
  • Review web and access logs for unauthenticated requests carrying file: URIs, _LAST_VIEW_NAME_ parameters, and direct logins using password-reset tokens

Workarounds

  • Place OFBiz behind a WAF or reverse proxy allow-list limiting reachable controllers
  • Disable or restrict the 'Send Per Email invoice' feature and SSO until patched

Longer-term hardening

  • Rotate the JWT security token key and any credentials or sessions on instances that ran 24.09.06/24.09.07 with legacy security configuration and SSO enabled
  • Audit .rest.xml definitions to ensure the auth attribute is explicitly set
  • Monitor OFBiz process for anomalous child process spawning

Affected and fixed versions

Timeline of Apache OFBiz pre-auth RCE

  • CVE-2026-68524 (pre-authentication RCE) reserved by the Apache Software Foundation
  • CVE-2026-73578 (saved-view authorization bypass) reserved
  • CVE-2026-82912 (EmailServices expression-language injection) reserved
  • CVE-2026-92887 (REST API missing authentication default) reserved
  • CVE-2026-105330 (hard-coded JWT key) reserved
  • CVE-2026-109928 (incorrect authentication algorithm in password-reset and login JWT validation) reserved
  • Jacopo Cappellato announces Apache OFBiz 24.09.08 and its security fixes on the oss-security mailing list
  • The Hacker News ThreatsDay bulletin reports 46 OFBiz flaws fixed, including pre-auth RCE and account takeover
  • CVE records for the 24.09.08 fixes, including CVE-2026-68524 and CVE-2026-109928, published with vendor severity 'important' and no CVSS score

Sources cited for Apache OFBiz pre-auth RCE

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats