What is the CVSS score of CVE-2026-31910?

CVE-2026-31910 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache OFBiz are affected by CVE-2026-31910?

Apache OFBiz versions before 24.09.06 contain a server-side request forgery (SSRF) vulnerability allowing unauthenticated attackers to access internal services and cloud metadata endpoints from the…. A patch is available.

How to fix or mitigate CVE-2026-31910?

Within 24 hours, inventory all systems running Apache OFBiz and identify those on versions prior to 24.09.06, prioritizing any instances accessible from the internet or cloud environments. Within 7 days, apply the vendor-released patch by upgrading OFBiz to version 24.09.06 or later on all affected systems, starting with externally exposed deployments. Within 30 days, complete patch deployment verification across all OFBiz instances, implement or strengthen outbound HTTP request filtering rules to prevent SSRF-based lateral movement, and review access logs for cloud metadata endpoints (169.254.169.254, similar ranges) for signs of exploitation attempts.

Apache OFBiz CVE-2026-31910

EUVD-2026-30870 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-19 apache

GHSA-7fjv-4hxj-5chr

Apache SSRF Apache Ofbiz Apache Software Foundation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated SSRF with low complexity (AV:N/AC:L/PR:N/UI:N); impact is confidentiality-only information disclosure, so C:H and I:A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:52 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:33 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:33 cve.org

HIGH 7.5

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound HTTP requests, enabling access to internal-only services, cloud metadata endpoints, and other network resources normally shielded from the internet. The CVSS 3.1 vector (7.5, C:H) reflects confidentiality-only impact, consistent with data exfiltration from internal targets rather than direct code execution. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile), indicating no observed exploitation activity despite the network-reachable, no-privilege attack surface.

Technical ContextAI

Apache OFBiz is a Java-based open-source enterprise resource planning (ERP) and e-commerce suite bundling accounting, CRM, order management, and a web storefront on an embedded application server. The flaw is classified CWE-918 (Server-Side Request Forgery), the root-cause class where a server fetches a user-supplied URL or host without adequately validating or restricting the destination, letting an attacker repurpose the server as a proxy into networks it can reach. The affected component is identified only by CPE cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:*, covering all Apache OFBiz builds prior to the fixed 24.09.06 release; the specific vulnerable request handler or feature is not detailed in the advisory.

RemediationAI

Vendor-released patch: upgrade Apache OFBiz to version 24.09.06, which fixes the issue, as directed by the Apache advisory at https://lists.apache.org/thread/2smc4c4o056ovd2hoq1l29593y5y29vh. Until the upgrade can be applied, reduce exposure by placing the OFBiz application behind a reverse proxy or firewall that restricts its outbound network egress so the server cannot reach internal address ranges or cloud metadata endpoints (e.g. 169.254.169.254), and restrict inbound access to the affected request handlers to trusted networks or authenticated users; be aware that egress filtering can break legitimate integrations that call external services, and inbound restrictions may impede public storefront functionality, so validate these controls against your deployment before enforcing them.