Apache OFBiz: pre-auth remote code execution and path traversal (CVE-2026-68524, CVE-2026-66903) fixed in 24.09.08
Published 05/11/2026 13:35
Timeline
3 events over 13 d
- 22/10/2026 16:26ConfirmedBSI CERT-Bund (WID)+13 d
- 05/11/2026 12:49CorroboratedBSI CERT-Bund (WID)+45 min
- 05/11/2026 13:35Published on WatchtowerPro CISO
In short
Apache OFBiz versions before 24.09.08 have several security flaws, including a pre-authentication remote code execution (CVE-2026-68524) and an authenticated path traversal (CVE-2026-66903). Version 24.09.08 fixes them. Update as soon as possible. Shodan estimates about 10.3 million internet-facing Apache httpd servers worldwide, 3.1 million of them in the EU (05/11/2026); how many run an affected version is not yet known.
How bad is it
Critical for internet-facing servers: an unauthenticated attacker may be able to run code on the OFBiz server (CVE-2026-68524); the path traversal needs a login.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
No CVSS score published yet
CVE-2026-66903, CVE-2026-68524: no score published yet. A missing score is never read as 0.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- All Apache OFBiz versions prior to 24.09.08.
Fixed in
- Apache OFBiz 24.09.08.
What to do now
- Update OFBiz to 24.09.08 or later.
- Interim measures reduce exposure and do not make a server safe; only the update does.
- Confirm which of your systems run OFBiz and which version.
- If OFBiz is reachable from the internet, treat the update as urgent because of the pre-authentication code execution flaw.
- Review web logs for unusual requests with JSON bodies, file: or .. in location parameters, and product image rename requests.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 3 sources with their dates. And technology matching: which of your systems run Apache httpd, at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [hoch] Apache HTTP Server: Mehrere Schwachstellen CERT · [NEU] [hoch] Apache OFBiz: Mehrere Schwachstellen CERT · Apache OFBiz: CVE Announcements Research