ofbiz vulnerabilities and fixes

Recent CVEs affecting ofbiz, with upgrade or downgrade steps. 19 tracked.

ofbiz has 19 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 19. Most recent: 2026-06-10. Highest priority: CVE-2026-45434 (score 69/100).

• CVE-2026-45434 CRITICAL 9.8 UPGRADE Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Ex
• CVE-2026-41919 CRITICAL 9.1 UPGRADE Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache O
• CVE-2026-31986 CRITICAL 9.1 UPGRADE Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24
• CVE-2026-46586 HIGH 8.8 UPGRADE Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamicall
• CVE-2026-31909 HIGH 7.5 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects
• CVE-2026-29220 MEDIUM 6.5 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.
• CVE-2026-29226 HIGH 7.3 UPGRADE Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue
• CVE-2026-31910 HIGH 7.5 UPGRADE Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.
• CVE-2026-31378 MEDIUM 6.5 UPGRADE Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. U
• CVE-2026-29207 MEDIUM 6.5 UPGRADE Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This iss
• CVE-2026-45187 MEDIUM 6.5 UPGRADE Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.
• CVE-2026-31380 MEDIUM 6.5 UPGRADE Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Inj
• CVE-2026-35086 MEDIUM 6.5 UPGRADE Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. Th
• CVE-2026-31387 MEDIUM 5.3 UPGRADE Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Use
• CVE-2026-31379 MEDIUM 6.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a
• CVE-2026-31388 MEDIUM 5.3 UPGRADE Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache
• CVE-2026-31906 MEDIUM 6.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache O
• CVE-2026-50223 HIGH 8.8 UPGRADE Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privilege
• CVE-2026-47342 HIGH 8.8 UPGRADE A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain high

FAQ

How do I fix ofbiz vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ofbiz being exploited right now?

None of the tracked ofbiz CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which ofbiz CVE should I patch first?

CVE-2026-45434 currently ranks highest (69/100): Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Ex.

RSS feed for ofbiz · ← Back to latest CVEs