Apache OFBiz CVE-2026-29226

Exploitation requires the target to be running Apache OFBiz before 24.09.06 with the Content component operations reachable by the attacker over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required against an exposed instance, so the primary limiting factor is network reachability of the Content component endpoints rather than any special configuration. Realistic impact is further bounded by what internal targets the OFBiz server can actually reach (egress-filtered deployments limit useful SSRF targets) and by the partial technical impact - the flaw yields internal request forgery, not direct code execution or full data disclosure.

The CVSS 3.1 base score is 7.3 (High) with vector AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, and no authentication or user interaction required, which makes the raw entry attractive to attackers. However, impact is limited to partial across all three dimensions (C:L/I:L/A:L), consistent with SSRF that leaks or manipulates internal request traffic rather than achieving full compromise. CISA SSVC classifies exploitation as 'none' observed, automatable 'yes', and technical impact 'partial', and EPSS is very low at 0.02% (4th percentile). The combination - no active exploitation, no KEV listing, no public POC, and low EPSS - suggests real-world priority is moderate rather than urgent, but the 'automatable: yes' SSVC flag and lack of authentication mean it is a plausible target for opportunistic scanning once details or a POC emerge, so patching should not be indefinitely deferred.

An unauthenticated attacker sends a crafted request to an OFBiz Content component operation supplying an attacker-chosen URL, causing the server to fetch that resource. The attacker points the request at an internal service or the cloud metadata endpoint to probe internal infrastructure or retrieve data the server can reach but the attacker cannot. No public POC is currently identified, but the low attack complexity and absence of authentication make crafting one straightforward.