# Apache OFBiz Pre-Auth RCE (CVE-2026-68524) and Account Takeover (CVE-2026-109928) Patched in 24.09.08

> Apache OFBiz 24.09.08 fixes a large batch of security issues (46 per The Hacker News, 47 per the oss-security announcement), including CVE-2026-68524 (pre-authentication RCE via an attacker-controlled Screen definition) and CVE-2026-109928 (account takeover via incorrect authentication algorithm in password-reset/login JWT validation). Sources do not report in-the-wild exploitation or assign CVSS scores.

- **Published:** 2026-11-05T15:35:05Z
- **Last reviewed:** 2026-11-05T15:35:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5328
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5328.png
- **ID:** TL-2026-5328
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-68524, CVE-2026-109928, CVE-2026-73578, CVE-2026-92887, CVE-2026-105330, CVE-2026-82912, CVE-2026-81815, CVE-2026-81816

## Description

On 2026-11-04 Apache OFBiz maintainer Jacopo Cappellato announced on oss-security that OFBiz 24.09.08 addresses a large set of vulnerabilities affecting all versions prior to 24.09.08. The Hacker News ThreatsDay bulletin of 2026-11-05 counts 46 flaws; the oss-security message lists 47 CVEs and the Apache security page lists 33 CVEs for this release, so the exact count differs between sources. All CVE records were published on 2026-11-05 with a vendor severity of 'important' and no CVSS score.

CVE-2026-68524 (CWE-94, reported by Naoya Takahashi / nakko) is a pre-authentication remote code execution flaw: an unauthenticated attacker can abuse temporary-file handling, reach an open file descriptor, and inject a 'file:' URI so that OFBiz loads an attacker-controlled Screen definition. Fixes are tracked in upstream pull requests #1528 and #1654.

CVE-2026-109928 (CWE-303, reported by CyberLeo) is an incorrect implementation of the authentication algorithm in the password-reset and login JWT validation in OFBiz 24.09 before 24.09.08. An attacker holding a password-reset token can authenticate directly through the login endpoint, bypassing the intended password-change flow and gaining full session access, potentially with administrative privileges.

The same release fixes further authentication and code-execution flaws that chain naturally with the headline issues: CVE-2026-73578 (CWE-288, missing authorization in RequestHandler.renderView; a crafted _LAST_VIEW_NAME_ parameter persists in anonymous sessions and bypasses authentication, with RCE impact per the advisory), CVE-2026-92887 (CWE-306/CWE-1188, REST operations callable unauthenticated when the auth attribute is omitted from .rest.xml because the parser defaults to false), CVE-2026-105330 (CWE-321, hard-coded factory-default JWT security token key lets unauthenticated attackers forge admin JWTs on 24.09.06 and 24.09.07 deployments that upgraded while retaining pre-existing security configuration with SSO enabled), and CVE-2026-82912 (CWE-917, expression-language injection in EmailServices 'Send Per Email invoice' form; bodyText/subject are processed through FlexibleStringExpander without Groovy sandboxing, allowing a low-privileged authenticated user to run OS commands). The advisory also lists SQL injection in performFind ignore-case values on MySQL/MariaDB (CVE-2026-81815) and XXE (CVE-2026-81816), plus authorization bypasses, path traversals, CSRF and disclosure flaws.

Exploitation status: none of the sources states exploitation in the wild, a public PoC, or threat actor attribution; the CISA KEV catalog was only partially inspected and no OFBiz entries were seen in the portion read. Because the fixes were published publicly on 2026-11-05 with commit/PR references, patch diffing is feasible and defenders should treat exposed OFBiz instances as high priority. No network IOCs were published, so no BeaconBeagle correlation was applicable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1606 Forge Web Credentials

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Apache OFBiz Java Process Spawning Shell or Interpreter** (`TL-2026-5328-SPL-002`)

Detects the OFBiz Java process spawning a shell or scripting interpreter. This is the main post-exploitation signal for every OFBiz RCE path fixed in 24.09.08 (CVE-2026-68524, CVE-2026-73578, CVE-2026-82912), because a healthy OFBiz process does not launch sh, bash, python, cmd or PowerShell.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059, T1059.004, T1190
- **Data sources:** sysmon_for_linux, sysmon_windows, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon (sourcetype="sysmon:linux" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") EventCode=1 earliest=-24h ```TL-2026-5328 OFBiz Java parent spawning shell - post-exploitation of CVE-2026-68524, CVE-2026-73578 and CVE-2026-82912```
| search ParentImage="*java*" ParentCommandLine="*ofbiz*"
| search Image IN ("*/sh", "*/bash", "*/dash", "*/zsh", "*/python*", "*/perl", "*cmd.exe", "*powershell.exe", "*pwsh.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as user by host, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("java", "java.exe", "javaw.exe")
| where InitiatingProcessCommandLine has "ofbiz"
| where FileName in~ ("sh", "bash", "dash", "zsh", "python", "python3", "perl", "cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Apache OFBiz Java Process Spawning Shell or Interpreter
id: 2f9d4b8a-61c3-4e57-8b0a-9e3f7a1c5d02
status: experimental
description: Detects a Java process running Apache OFBiz that spawns a shell or scripting interpreter, the post-exploitation indicator for the OFBiz RCE flaws fixed in 24.09.08 (CVE-2026-68524, CVE-2026-73578, CVE-2026-82912).
references:
  - https://www.openwall.com/lists/oss-security/2026/11/04/9
  - https://ofbiz.apache.org/security.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.004
  - attack.initial-access
  - attack.t1190
  - cve.2026.68524
  - cve.2026.82912
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '\java.exe'
      - '\javaw.exe'
    ParentCommandLine|contains: 'ofbiz'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Administrator-written OFBiz start or maintenance scripts that shell out from the Java process
  - Custom OFBiz services that intentionally invoke an OS script
level: high
```

**Known false positives:**

- Custom OFBiz services or admin scripts that intentionally exec an OS shell
- Build or deployment tooling that starts OFBiz from a wrapper shell and is parsed as a child of the java process

**Tuning notes:** Baseline the OFBiz hosts for a week and allow-list known CommandLine values such as backup or print scripts. Make sure Sysmon for Linux or EDR process telemetry is deployed on every OFBiz server. Raise severity if the child runs as the OFBiz service account and has a network-facing command line.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Apache OFBiz Token-Based Login Without Interactive Login (CVE-2026-109928 / CVE-2026-105330) (locked: unlock with TL Creds)
- Apache OFBiz Java Process Writing Web Content or Payload Files (locked: unlock with TL Creds)
- Apache OFBiz Java Process Outbound Connection to Public IP on Unusual Port (locked: unlock with TL Creds)
- Apache OFBiz Expression Injection in bodyText or subject Parameter (CVE-2026-82912) (locked: unlock with TL Creds)
- Apache OFBiz Child Process Establishing Persistence (Cron, Account Creation, SSH Keys, Scheduled Task) (locked: unlock with TL Creds)
- Apache OFBiz Child Process Running Lateral Movement or Tunneling Tools (locked: unlock with TL Creds)
- Apache OFBiz Exploitation Request - file: URI and _LAST_VIEW_NAME_ Abuse (CVE-2026-68524 / CVE-2026-73578) (locked: unlock with TL Creds)
- Apache OFBiz Child Process Downloader or Reverse Shell Command (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories](https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html)
- [oss-security: Apache OFBiz 24.09.08 security advisory](https://www.openwall.com/lists/oss-security/2026/11/04/9)
- [Apache OFBiz Security Information](https://ofbiz.apache.org/security.html)
- [Apache security mailing list thread (vendor advisory referenced by CVE records)](https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz)
- [CVE-2026-68524 CVE record](https://cveawg.mitre.org/api/cve/CVE-2026-68524)
- [CVE-2026-109928 CVE record](https://cveawg.mitre.org/api/cve/CVE-2026-109928)
- [CVE-2026-73578 CVE record](https://cveawg.mitre.org/api/cve/CVE-2026-73578)
- [CVE-2026-105330 CVE record](https://cveawg.mitre.org/api/cve/CVE-2026-105330)
- [CVE-2026-82912 CVE record](https://cveawg.mitre.org/api/cve/CVE-2026-82912)
- [CVE-2026-92887 CVE record](https://cveawg.mitre.org/api/cve/CVE-2026-92887)
- [NVD: CVE-2026-68524](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-68524)
- [NVD: CVE-2026-109928](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-109928)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5328