Apache OFBiz CVE-2026-31986

Exploitation requires the target to be running Apache OFBiz before 24.09.06 and reachable over the network, plus the attacker possessing the hard-coded key - which, given OFBiz is open source, is recoverable from the codebase and effectively identical across all installations, so this is not a meaningful barrier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special non-default configuration is stated as required. The practical limiting factor is what the key actually protects: real impact depends on the attacker being able to reach the specific encrypted data or key-using endpoint, a detail the advisory does not spell out; there is no availability impact (A:N), so this is a confidentiality/integrity issue, not a denial-of-service.

Signals here are mixed and should be weighed rather than taken at face value. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) implies a trivially reachable, unauthenticated, low-complexity network attack with high confidentiality and integrity impact - consistent with a globally-shared secret. SSVC reinforces this: Automatable=yes and Technical Impact=total. However, EPSS is only 0.02% (4th percentile) and the CVE is NOT on CISA KEV, and SSVC Exploitation=none, indicating no observed exploitation. This is a genuine high-severity design flaw worth prioritizing for patching, but the low EPSS suggests it is not yet being mass-exploited - likely because weaponizing a hard-coded key depends on what data that specific key actually protects, which the terse advisory does not disclose. Note the tension: the vector claims a pure network vector with no privileges, yet abusing a static key often requires the attacker to also reach the encrypted data or an endpoint that uses it; verify the concrete attack surface against the Apache advisory before assuming pure remote exploitation.

An attacker reads the publicly available Apache OFBiz source to recover the hard-coded cryptographic key, then uses it against an Internet-exposed OFBiz instance to decrypt sensitive protected data or forge/tamper with values the key is meant to secure. Given AV:N/AC:L/PR:N, this requires only network access to a vulnerable server and no authentication; no public exploit code has been identified at time of analysis.