Apache OFBiz CVE-2026-31909

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions - remote unauthenticated exploitation over the network against Apache OFBiz instances before 24.09.06, with no user interaction and low complexity. The limiting factors are that the affected OFBiz web service must be network-reachable by the attacker (instances restricted to internal networks or behind a VPN reduce exposure) and that impact is confined to confidentiality - the flaw discloses information but does not allow modification or denial of service. The specific vulnerable endpoint or feature is not named in the available advisory data, so the precise request required is not confirmed.

The signals are mixed and point to a moderate, not urgent, priority. CVSS 7.5 reflects an easy-to-reach vector (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact but no integrity or availability effect. SSVC classifies Exploitation as 'none' (no observed or public exploitation) while marking it Automatable:yes with partial Technical Impact - meaning if an exploit emerged it could be scripted broadly, but none exists today. EPSS is very low at 0.02% (5th percentile), and there is no KEV listing and no public exploit identified, consistent with the SSVC 'none' rating. The high CVSS is driven almost entirely by the unauthenticated network reach plus confidentiality loss; the real-world urgency is tempered by the absence of any exploitation evidence. Net: patch on a normal cycle rather than emergency, but note the automatable flag means opportunistic scanning could follow if a POC is published.

An unauthenticated attacker who can reach the OFBiz web interface over the network sends a crafted request to an affected endpoint and receives sensitive information back in the response without needing credentials or user interaction. Because SSVC marks the issue automatable, such requests could be scripted across many exposed instances, though no public exploit is identified at time of analysis.