Apache OFBiz CVE-2026-31380

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates exploitation requires no authentication, no elevated privileges, and no user interaction - any network-reachable OFBiz instance prior to 24.09.06 is potentially vulnerable without special configuration. Limiting factors include the partial impact ceiling (C:L/I:L/A:N), meaning an attacker cannot achieve full system compromise or denial of service through this vector alone. The vulnerability affects the expression language evaluation pathway within OFBiz; specific endpoints or input parameters that invoke EL evaluation are the trigger surface. The SSVC classification of 'Automatable: yes' confirms no per-target manual steps are required, but exploitation is bounded to the OFBiz application context rather than the underlying OS or adjacent systems (S:U, scope unchanged).

Cross-referencing available signals produces a mixed but moderately prioritized picture. The CVSS 3.1 score of 6.5 with AV:N/AC:L/PR:N/UI:N indicates low-complexity, unauthenticated network exploitation - a configuration that should drive urgency. SSVC corroborates this with 'Automatable: yes', meaning an attacker could script mass scanning and exploitation attempts without manual intervention per target. However, SSVC also rates Technical Impact as 'partial', consistent with CVSS C:L/I:L/A:N - no full system compromise or availability impact is indicated. The EPSS score of 0.03% (8th percentile) is notably low, suggesting the security community has not observed active exploitation tooling or campaigns targeting this CVE at scale. KEV status is absent from the provided data, and no POC is identified. The tension between an automatable, unauthenticated network vector and a very low EPSS score suggests either the vulnerability is not yet widely known to threat actors, requires specific endpoint or configuration to trigger, or the low impact ceiling (C:L/I:L) limits attacker interest. For organizations running public-facing OFBiz instances, the automatable and unauthenticated nature warrants prompt patching despite the tempered EPSS signal. No conflicting data between sources is noted.

An unauthenticated attacker sends a crafted HTTP request to a publicly accessible OFBiz endpoint, embedding an EL expression (e.g., a '${...}' payload) in a query parameter or form field processed by the application's expression evaluation layer. The OFBiz framework evaluates the injected expression in the server's Java context without sanitization, returning evaluated data or causing unintended state changes. No public exploit code has been identified at time of analysis, but the low complexity and automatable nature of the attack means scripted mass exploitation is feasible once a specific vulnerable endpoint and payload are established.