What is the CVSS score of CVE-2026-31986?

CVE-2026-31986 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache OFBiz are affected by CVE-2026-31986?

Apache OFBiz before version 24.09.06 contains a hard-coded cryptographic key used across all deployments, enabling remote attackers to decrypt sensitive business data and forge authentication…. A patch is available.

How to fix or mitigate CVE-2026-31986?

Within 24 hours, inventory all Apache OFBiz deployments and identify those running versions before 24.09.06. Within 7 days, upgrade all affected installations to Apache OFBiz 24.09.06 or later to obtain the vendor patch, and regenerate all cryptographic keys post-upgrade to ensure fresh key material replaces the compromised default. Within 30 days, perform a cryptographic audit and review application access logs from the vulnerability window for evidence of unauthorized data access, forged sessions, or manipulation of encrypted information.

Apache OFBiz CVE-2026-31986

EUVD-2026-30873 CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2026-05-19 apache

GHSA-xj47-w234-57fj

Apache Information Disclosure Apache Ofbiz Apache Software Foundation

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Open-source hard-coded key is network-recoverable with no auth or interaction (AV:N/AC:L/PR:N/UI:N), enabling decryption and forgery (C:H/I:H) but no availability loss (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:51 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:34 cve.org

CRITICAL 9.1

CVE Published

May 19, 2026 - 09:34 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Sensitive data exposure and integrity compromise in Apache OFBiz before 24.09.06 stems from a hard-coded cryptographic key (CWE-321) shipped with the product, meaning every deployment shares the same secret. Remote unauthenticated attackers who know or extract this key from the open-source codebase can decrypt or forge protected data, undermining any cryptographic protection that relies on it. No public exploit is identified at time of analysis, and EPSS rates near-term exploitation probability very low (0.02%), but SSVC scores the technical impact as total and automatable.

Technical ContextAI

Apache OFBiz is an open-source enterprise resource planning (ERP) and e-commerce suite (accounting, CRM, order/inventory/warehouse management) built on Java. The flaw is CWE-321 (Use of a Hard-coded Cryptographic Key): a cryptographic key is embedded directly in the shipped source/binary rather than generated per-installation or stored in an external secret. Because OFBiz is open source, any hard-coded key is trivially recoverable by reading the repository, so it provides no real secrecy - all instances running affected versions effectively share one publicly-derivable key. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_ofbiz, all versions prior to 24.09.06.

RemediationAI

Vendor-released patch: upgrade Apache OFBiz to version 24.09.06, which fixes the issue, per the Apache advisory at https://lists.apache.org/thread/2hl9xoqm8tq8b22x6vnmtp7tg3opcqgc. Because the root cause is a shared hard-coded key, upgrading alone may not be sufficient if the old key was already used to encrypt or sign existing data - after patching, rotate or re-encrypt any secrets, tokens, or stored data that depended on the previous key, following any key-rotation guidance in the advisory. As compensating controls until you can patch, restrict network exposure of the OFBiz application (place it behind a VPN or firewall and block direct Internet access to its HTTP/HTTPS ports), and monitor for anomalous access to endpoints handling encrypted data; the trade-off is reduced accessibility for legitimate remote users and no protection against an attacker who already has network reach.