What is the CVSS score of CVE-2026-31378?

CVE-2026-31378 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-31378?

Yes, a patch is available for CVE-2026-31378. Update the affected software to the latest version immediately.

Apache OFBiz CVE-2026-31378

EUVD-2026-30856 MEDIUM

Improper Input Validation (CWE-20)

2026-05-19 apache

GHSA-r6v2-rh7v-5j2x

Apache Information Disclosure Apache Ofbiz Apache Software Foundation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated attack with no interaction aligns with PR:N/UI:N; partial C and I impact match CWE-20 and information disclosure tag; no availability or scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:55 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:21 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:21 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Input Validation vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Improper input validation in Apache OFBiz before 24.09.06 allows unauthenticated remote attackers to achieve partial confidentiality and integrity impact over the network with no attack complexity or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). SSVC analysis classifies the flaw as automatable with partial technical impact, meaning it is feasible for automated tools to probe and potentially exploit at scale. No active exploitation has been confirmed - EPSS stands at just 0.04% (11th percentile) and the vulnerability is absent from CISA KEV - indicating current real-world exploitation is unlikely despite the broadly accessible attack surface.

Technical ContextAI

Apache OFBiz is an open-source enterprise resource planning (ERP) framework maintained by the Apache Software Foundation, providing e-commerce, accounting, manufacturing, and HR modules via a Java-based web application. The vulnerability is classified under CWE-20 (Improper Input Validation), meaning the application fails to properly validate, sanitize, or constrain user-controlled input before it is processed by the server. In web-facing ERP systems, CWE-20 failures commonly manifest as bypass of access controls, injection into backend logic, or extraction of data through unexpected code paths. The CPE string cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:* confirms the vulnerability affects the entire OFBiz product line up to but not including version 24.09.06, with no platform or deployment-mode restrictions specified.

RemediationAI

Upgrade Apache OFBiz to version 24.09.06 or later - this is the vendor-confirmed fix as documented in the Apache mailing list advisory at https://lists.apache.org/thread/cbl8qkqtxv90m6ssfwd58bnoh933v38t. If immediate upgrade is not feasible, restrict external network access to OFBiz endpoints at the perimeter using a web application firewall or reverse proxy, specifically blocking or rate-limiting unauthenticated requests to endpoints that process user-controlled parameters. Note that overly aggressive WAF rules risk blocking legitimate ERP operations and should be validated against production traffic patterns before full deployment. Additionally, enable detailed access logging on the OFBiz application and monitor for anomalous unauthenticated request patterns as a detection compensating control. Isolating OFBiz from direct internet exposure (placing it behind a VPN or internal network boundary) substantially reduces the exploitable attack surface while a patch window is arranged.