Apache OFBiz CVE-2026-81815

Exploitation requires the OFBiz deployment to use a MySQL or MariaDB datasource, because the flaw depends on those dialects honoring backslash escapes; the default Derby datasource and PostgreSQL are explicitly not affected and cannot be exploited this way. The attacker must reach the entity engine's generic performFind service and submit an ignore-case find request (e.g. _ic=Y) with a backslash-terminated crafted value so that SqlJdbcUtil.addValueSingle inlines the EntityFunction-wrapped value using ANSI single-quote doubling only. Limiting factors: only OFBiz 24.09 before 24.09.08 is affected, and the database backend must be MySQL/MariaDB - a non-universal (though common) configuration - while no authentication or user interaction is required (PR:N/UI:N) once those conditions hold.

Signals diverge sharply. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and 9.8 score describe a network-reachable, unauthenticated, low-complexity flaw, and the vuln.today Decision label is act_now - all pointing to high urgency. However, the described impact is limited to disclosure of arbitrary rows from the queried entity (a read/tautology primitive), so the input's C:H/I:H/A:H is not fully supported by the mechanism described, which establishes confidentiality impact but not integrity or availability. Exploitation is further gated to MySQL/MariaDB-backed deployments; default Derby and PostgreSQL installations are explicitly not affected, which materially narrows the real-world population. EPSS is low (0.28%, 20th percentile) and the CVE is not in CISA KEV with no public exploit identified, indicating no evidence of widespread or automated exploitation yet. Net: treat as a genuine, patch-now priority for OFBiz 24.09 instances running on MySQL/MariaDB, but the headline 9.8 overstates both the impact breadth (disclosure-only per the description) and the deployment breadth (MySQL/MariaDB only); low EPSS and absence of KEV/PoC argue against imminent mass exploitation.

A remote, unauthenticated attacker sends an ignore-case find request (e.g. with _ic=Y) to the generic performFind service on an OFBiz 24.09 instance backed by MySQL or MariaDB, supplying a backslash-terminated value that escapes the inlined single-quoted string literal and converts the WHERE clause into a tautology, returning arbitrary rows of the queried entity. No public exploit is identified at the time of analysis, and the attack only succeeds against MySQL/MariaDB deployments, not the default Derby or PostgreSQL datasources. Low attack complexity (AC:L) and no authentication (PR:N) make the request itself trivial to craft once a vulnerable backend is present.