Apache OFBiz CVE-2026-31378

No special conditions are required beyond network reachability - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is remotely exploitable by unauthenticated attackers against default configurations of Apache OFBiz versions before 24.09.06. No specific OFBiz feature, module, or non-default configuration setting is cited as a prerequisite in available references. Exploitation is bounded by the following limiting factors: impact is confined to the vulnerable OFBiz application instance with no scope change (S:U), meaning an attacker cannot leverage this flaw alone to pivot into adjacent systems; confidentiality and integrity are only partially affected (C:L/I:L) with no availability impact; and the specific endpoint or input field triggering the flaw has not been publicly disclosed, adding a de facto information barrier that partially limits exploitation by unsophisticated actors.

The CVSS 6.5 Medium score is supported by a network-accessible, unauthenticated, low-complexity vector with no user interaction required - a combination that makes this broadly exploitable without operator assistance. The partial C:L and I:L impact components align with the 'Information Disclosure' tag and SSVC's 'partial technical impact' designation. However, the EPSS score of 0.04% at the 11th percentile strongly indicates this vulnerability has not been operationalized by threat actors and is not being actively scanned or exploited in the wild. The SSVC 'automatable: yes' finding creates a meaningful tension with the low EPSS - the attack surface is theoretically mass-exploitable, but exploitation has not materialized at scale. No KEV listing and no identified POC further reduce urgency. The key risk differentiator is the OFBiz deployment context: internet-facing ERP instances represent a higher-priority patch target than internally-accessible ones. No data conflicts exist across sources, but the exact vulnerable endpoint or parameter is not disclosed in available references, which limits ability to assess exploitability independently of the vendor's characterization.

An unauthenticated attacker sends a specially crafted HTTP request containing malformed or boundary-violating input to a publicly accessible Apache OFBiz endpoint, bypassing server-side input validation logic. The application processes the malformed input, resulting in partial exposure of application data or manipulation of application state - consistent with the C:L and I:L impact components. No public proof-of-concept exploit has been identified at time of analysis, but the automatable SSVC designation means adversaries with general scanning tooling could probe for this at scale once a working technique is developed.