What is the CVSS score of CVE-2026-41919?

CVE-2026-41919 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache OFBiz are affected by CVE-2026-41919?

Apache OFBiz (versions <24.09.06) contains a critical LDAP injection vulnerability enabling authentication bypass and sensitive directory data extraction.. A patch is available.

How to fix or mitigate CVE-2026-41919?

Within 24 hours, identify all systems running Apache OFBiz and catalog deployed versions across your infrastructure. Within 7 days, upgrade all affected instances to Apache OFBiz version 24.09.06 or later, conducting testing in staging environments to verify application compatibility before production deployment. Within 30 days, complete patching across all OFBiz installations and perform vulnerability scanning to confirm remediation.

Apache OFBiz CVE-2026-41919

Q: How to fix or mitigate CVE-2026-41919?

Within 24 hours, identify all systems running Apache OFBiz and catalog deployed versions across your infrastructure. Within 7 days, upgrade all affected instances to Apache OFBiz version 24.09.06 or later, conducting testing in staging environments to verify application compatibility before production deployment. Within 30 days, complete patching across all OFBiz installations and perform vulnerability scanning to confirm remediation.

EUVD-2026-30875 CRITICAL

LDAP Injection (CWE-90)

2026-05-19 apache

GHSA-9pfq-c8xc-7q54

LDAP Code Injection Apache Apache Ofbiz

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Network-reachable LDAP-backed login is unauthenticated and low-complexity (AV:N/AC:L/PR:N/UI:N); injection enables auth bypass and data extraction (C:H/I:H) with no service disruption (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:51 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:36 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:36 cve.org

CRITICAL 9.1

DescriptionCVE.org

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

LDAP injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject special characters into LDAP queries, bypassing authentication or extracting directory data with high confidentiality and integrity impact. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but the CVSS 9.1 rating and CISA SSVC 'total' technical impact make it a meaningful patching priority. A vendor patch is available in version 24.09.06.

Technical ContextAI

Apache OFBiz is an open-source enterprise resource planning (ERP) suite bundling e-commerce, CRM, accounting, and inventory modules on a Java-based web application stack. The flaw is CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query), meaning user-supplied input reaches an LDAP query without proper escaping of metacharacters such as '*', '(', ')', '\', and NUL. When OFBiz is configured to authenticate or resolve users against an LDAP/Active Directory backend, an attacker can manipulate the filter logic to alter the query's meaning. The CPE cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:* confirms all product versions prior to the fix are in scope.

RemediationAI

Upgrade to Apache OFBiz 24.09.06, the vendor-released patched version that fixes the LDAP injection, as documented in the Apache advisory at https://lists.apache.org/thread/592czh9o69n74c036vy30fnqknocw74p. If immediate upgrade is not feasible and OFBiz is integrated with an LDAP/Active Directory backend, compensating controls include disabling LDAP-based authentication in OFBiz and reverting to the internal user store (trade-off: breaks single sign-on and centralized identity management), restricting network access to the OFBiz web tier so only trusted clients can reach login and directory-backed endpoints (trade-off: does not protect against authenticated internal users), and applying input validation or a WAF rule to reject LDAP metacharacters ('*', '(', ')', '\', NUL) in authentication-related parameters (trade-off: may cause false positives for legitimate usernames and is not a substitute for the fixed code path). Verify the deployed version after upgrade.