Apache OFBiz CVE-2026-35086

The vulnerability requires the Apache OFBiz email services component to be reachable over the network and processing attacker-supplied input - no authentication is required per the CVSS vector (PR:N). There is no indication from available data that a non-default configuration or specific feature flag must be enabled; any standard OFBiz deployment with email services active is potentially affected. Exploitation is limited to OFBiz versions prior to 24.09.06. The unchanged scope (S:U) constrains impact to the OFBiz application process itself, and the partial CVSS impact ratings (C:L/I:L/A:N) suggest the code injection context may impose runtime restrictions on what injected code can reach. Deployments where OFBiz is not internet-exposed or where email services are disabled face significantly reduced risk.

The CVSS 6.5 medium score reflects a network-accessible, unauthenticated, low-complexity attack, but is tempered by partial impact (C:L/I:L/A:N) and unchanged scope. SSVC signals a meaningful tension: exploitation is currently 'none' and technical impact is 'partial,' yet the attack is classified as 'automatable' - meaning if exploitation matures, mass scanning campaigns are feasible. EPSS at 0.03% (8th percentile) aligns with the absence of a known public PoC or KEV listing, suggesting the vulnerability has not attracted exploit development at scale. The RCE tag in the intelligence data conflicts with the vendor-assigned partial impact scores - either the code injection is constrained in what it can execute (e.g., sandboxed template context), or the vendor may have conservatively scoped the impact; this discrepancy is not independently resolved by available data. Net assessment: moderate priority for organizations running OFBiz, elevated if email services are internet-exposed, but not an emergency given current exploitation evidence.

An unauthenticated attacker sends a crafted HTTP request to an internet-accessible Apache OFBiz email service endpoint, embedding template expressions or script payloads in a controlled input field such as an email subject or body parameter. The OFBiz email rendering engine evaluates the payload as code, executing attacker-controlled instructions within the application context and potentially allowing limited data exfiltration or integrity manipulation. No public proof-of-concept has been identified at time of analysis, but the automatable SSVC classification indicates tooling for mass exploitation could be developed.