Apache OFBiz CVE-2026-46586

Attacker must hold a valid low-privileged OFBiz account (CVSS PR:L) and have network reachability to an OFBiz webapp endpoint that funnels input into the vulnerable dynamic evaluator; no user interaction is required (UI:N) and attack complexity is low (AC:L). The flaw affects any deployment running Apache OFBiz prior to 24.09.06 in its default scripting-enabled configuration - Groovy/eval-based handlers are enabled out of the box, so no non-default toggle is needed. Exploitation is limited by the authentication requirement, meaning anonymous internet scanning alone will not yield RCE; however, deployments that permit customer self-registration via the ecommerce webapp effectively reduce this to an unauthenticated-equivalent condition. The advisory does not name the specific vulnerable endpoint or parameter, so the precise sink should be confirmed against the upstream commit before relying on endpoint-level mitigations.

Signals diverge sharply on this CVE. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and the RCE tag describe a high-impact network-reachable flaw needing only low privileges, and SSVC marks it 'Automatable: yes' - both pointing to priority patching for any internet-exposed OFBiz instance. Counterweighting these, EPSS sits at 0.03% (8th percentile), SSVC exploitation status is 'none', the issue is not on the CISA KEV list, and no POC has been published, so real-world exploitation pressure is currently low. The PR:L requirement (any valid OFBiz account, including self-registered customer accounts on some deployments) is a meaningful gating factor but historically thin given OFBiz's prior CVE pattern, where authenticated RCEs were rapidly weaponized once researchers published technical write-ups. SSVC's 'Technical Impact: partial' appears to conflict with the CVSS C:H/I:H/A:H rating - security teams should treat this as a probable full-RCE pending a confirmed analysis, not downgrade based on the partial label.

A self-registered or compromised low-privilege OFBiz account holder sends a crafted HTTP request to an OFBiz endpoint that funnels parameters into a dynamic script evaluator, injecting Groovy directives that execute Runtime.exec() to spawn a reverse shell with the privileges of the OFBiz Java process. From this foothold, the attacker pivots to the OFBiz Derby/PostgreSQL backend to exfiltrate customer, order, and accounting data, or stages secondary tooling for lateral movement. No public exploit is identified at time of analysis, but Apache OFBiz has a strong track record of rapid POC publication following code-injection disclosures.