Apache OFBiz CVE-2026-41919

Exploitation requires that the target Apache OFBiz instance (any version before 24.09.06) be configured to use its LDAP authentication/directory integration, since the injectable sink is an LDAP query - deployments relying solely on the default internal database user store are not exposed via this vector. Where LDAP is enabled, the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low complexity: a remote attacker only needs network reach to the affected input (typically a login or user-lookup parameter). The primary limiting factor is therefore the non-default requirement that LDAP authentication be active; secondary limiting factors are network exposure of the OFBiz web tier and the running version being below 24.09.06.

The signals are partially conflicting and should be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, score 9.1) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact but no availability impact - consistent with LDAP data extraction and authentication tampering rather than service disruption. CISA's SSVC framework rates Automatable=yes and Technical Impact=total, reinforcing that successful exploitation fully compromises the affected component and could be scripted. However, EPSS is only 0.03% (8th percentile) and SSVC Exploitation=none, and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation. A key caveat: the high score assumes OFBiz is actually deployed with LDAP authentication enabled; installations using the default internal database-backed authentication may not be exposed to this specific vector - verify configuration before ranking urgency.

An attacker reaches an internet-facing Apache OFBiz login or directory lookup endpoint on an instance configured for LDAP authentication and submits a username field containing crafted LDAP filter metacharacters such as '*)(uid=*))(|(uid=*'. Because the input is not neutralized, the query logic is altered, letting the attacker bypass authentication or enumerate directory attributes without valid credentials. No public exploit code has been identified, but the low attack complexity and SSVC 'automatable=yes' rating mean a working exploit could be scripted quickly.