CVE-2026-46586: Apache OFBiz RCE Vulnerability Explained

CVE-2026-46586 Overview

CVE-2026-46586 is a code injection vulnerability affecting Apache OFBiz, the open-source enterprise resource planning (ERP) system. The flaw stems from improper control of generated code and improper neutralization of directives in dynamically evaluated code [CWE-94]. Authenticated attackers with low privileges can exploit this issue over the network to execute arbitrary code within the OFBiz runtime context.

The vulnerability impacts all Apache OFBiz versions prior to 24.09.06. The Apache OFBiz project has released version 24.09.06 to address the issue.

Critical Impact
Successful exploitation allows authenticated remote attackers to execute arbitrary code, leading to full compromise of confidentiality, integrity, and availability of the OFBiz application and underlying host.

Affected Products

Apache OFBiz versions before 24.09.06
Deployments exposing OFBiz web endpoints to authenticated users
ERP, CRM, and e-commerce integrations built on the Apache OFBiz framework

Discovery Timeline

2026-05-19 - CVE-2026-46586 published to NVD
2026-05-19 - Apache project posts advisory to the Apache Mailing List
2026-05-19 - Disclosure published to OpenWall OSS-Security
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-46586

Vulnerability Analysis

The vulnerability is classified as Code Injection and Eval Injection under [CWE-94]. Apache OFBiz processes user-supplied input through dynamic code evaluation paths without enforcing sufficient validation. An authenticated attacker can craft input that the application interprets as executable code rather than data.

Exploitation requires network access and valid low-privilege credentials. No user interaction is needed. Successful attacks deliver high impact across confidentiality, integrity, and availability, since injected code runs with the privileges of the OFBiz application process.

The EPSS probability for this vulnerability is 0.106% with a percentile of 28.187. While exploitation activity has not been observed publicly, OFBiz historically attracts attention from attackers due to its prevalence in enterprise back-office environments.

Root Cause

The root cause is the unsafe handling of dynamically evaluated expressions inside Apache OFBiz. Specific code paths accept attacker-controllable strings and pass them to evaluators without neutralizing directives, characters, or constructs that change the meaning of the evaluated code. This allows attacker input to break out of the intended data context and into the code execution context.

Attack Vector

The attack vector is network-based against authenticated OFBiz users. An attacker submits malicious payloads to a vulnerable endpoint, where the payload is parsed and executed by the dynamic evaluator. Because OFBiz exposes a broad set of business functions over HTTP, the attack surface includes screens, services, and request handlers that internally invoke expression evaluation. Refer to the Apache Mailing List advisory for specific component details.

Detection Methods for CVE-2026-46586

Indicators of Compromise

Unexpected child processes spawned by the OFBiz Java process, such as sh, bash, cmd.exe, or powershell.exe
Outbound network connections from the OFBiz host to unknown IPs or rare geographies
HTTP request bodies or parameters containing scripting syntax, Groovy constructs, or expression language payloads
New or modified files in OFBiz runtime/, webapp/, or temporary directories outside normal deployment activity

Detection Strategies

Inspect application and access logs for requests carrying suspicious characters used in expression injection, such as ${, #{, backticks, and unbalanced quotes
Correlate authentication events with anomalous service or screen requests from the same session
Apply web application firewall (WAF) rules that flag expression language and template injection patterns against OFBiz endpoints

Monitoring Recommendations

Forward OFBiz access, error, and audit logs to a centralized SIEM for behavioral analysis
Alert on the OFBiz JVM creating shell processes or initiating outbound connections outside known integration partners
Track failed and successful logins from low-privilege accounts followed by access to administrative or scripting features

How to Mitigate CVE-2026-46586

Immediate Actions Required

Upgrade Apache OFBiz to version 24.09.06 or later as recommended by the project
Inventory all OFBiz deployments, including development, staging, and integration environments
Rotate credentials for any accounts that may have been exposed on a vulnerable instance
Review recent logs for evidence of exploitation attempts against authenticated endpoints

Patch Information

The Apache OFBiz project fixed this issue in version 24.09.06. Administrators should plan an upgrade following the official guidance in the Apache Mailing List advisory and the OpenWall OSS-Security notice. After upgrading, validate that custom screens, services, and integrations still function with the patched evaluators.

Workarounds

Restrict access to OFBiz to trusted networks via VPN or IP allowlists until patching completes
Disable or limit user accounts that are not strictly required for business operations
Deploy WAF rules that block expression language and code injection patterns on OFBiz request handlers
Run the OFBiz process under a least-privilege service account to reduce blast radius if exploited

bash

# Configuration example: verify installed Apache OFBiz version
cd /opt/ofbiz
./gradlew --version
grep -R "release.version" ./common.gradle
# Confirm output reports 24.09.06 or later