Apache OFBiz CVE-2026-81816

Exploitation requires an attacker to deliver attacker-controlled XML to an OFBiz component whose parser resolves external entities; the specific feature, endpoint, or deployment mode that exposes the vulnerable parser is not identified in the batch announcement, and the trigger is not described in the available sources. Authentication requirements are not confirmed from the available data - no CVSS vector was supplied, so it cannot be stated whether this is pre- or post-authentication. The one concrete boundary confirmed by the vendor is version-based: all releases prior to Apache OFBiz 24.09.08 are affected, and the vendor states upgrading to 24.09.08 is the remediation.

Risk for this specific CVE cannot be fully quantified from the supplied data, and this must be stated plainly: no CVSS vector or score was provided (CVSS: N/A), no EPSS exploitation-probability score was supplied, there is no CISA KEV listing, and no SSVC technical-impact/automatable breakdown accompanies this entry. The vuln.today decision label is 'awaiting_data', which is consistent with that gap - this is not an act_now or emergency classification, but it also does not mean low risk; it means the signals needed to rank it are not yet present. The only intrinsic signal is the vulnerability class itself: XML external entity (XXE) injection, which by definition permits an attacker who can submit crafted XML to coerce the parser into resolving external entities, typically yielding local file disclosure and/or server-side request forgery, and in some parsers a denial-of-service (entity expansion). Important caveat: this CVE is announced only as a one-line title inside a batch oss-security advisory covering 40+ OFBiz issues, several of which are far more severe (e.g. CVE-2026-68524 pre-auth RCE, CVE-2026-105330 hard-coded JWT key). The authentication requirement for THIS XXE is not stated and cannot be inferred from the available text. Net: treat as a genuine confidentiality/SSRF-class flaw worth patching on the normal cycle via the OFBiz 24.09.08 upgrade, but note that its real-world priority relative to the other OFBiz CVEs in the same batch is currently unestablished pending CVSS/EPSS data.

An attacker reaches an OFBiz endpoint that accepts and parses XML input and submits a document defining an external entity pointing at a local file or an internal URL; if OFBiz's XML parser resolves external entities, the response or downstream processing leaks local file contents or forces the server to make attacker-directed internal requests (SSRF). No public exploit has been identified at time of analysis, and the exact vulnerable endpoint and whether authentication is required are not described in the available sources.