Apache OFBiz CVE-2026-97355

Exploitation requires network reach to the Apache OFBiz AdminServer service-control listener and knowledge of the hard-coded credential; because the credential is static and shipped with the product, no valid user account is needed once the port is reachable. The key limiting factor is exposure of that control port: in default OFBiz deployments the AdminServer is bound to the loopback interface, so an attacker must either be local/adjacent or the operator must have deliberately exposed the port to a wider network for remote exploitation to succeed. The precise command sequence that triggers the shutdown is not described in the available sources. Impact is confined to availability; there is no associated data disclosure or code execution.

This is a single DoS issue (CVE-2026-97355: hard-coded credentials in the OFBiz AdminServer) bundled inside a large multi-CVE Apache OFBiz announcement. The real-world risk signals are mostly absent: no CVSS vector, no EPSS score, no CISA KEV listing, and no proof-of-concept are present in the input, and the vuln.today decision label is 'awaiting_data' - meaning priority is explicitly undetermined rather than high. On mechanism alone, hard-coded credentials (CWE-798) in a service-control component remove the authentication barrier, and the stated impact is unauthenticated denial of service only - no confidentiality or integrity loss and no code execution - which makes this materially less severe than the pre-auth RCE entries (e.g. CVE-2026-68524, CVE-2026-83542) disclosed in the same batch. The dominant unknown is network reachability: OFBiz's AdminServer control port is bound to localhost by default in many deployments, so whether this is remotely reachable (true network DoS) or only locally/adjacently exploitable is NOT established by the available sources. If the admin port is not exposed, real risk is low despite the 'unauthenticated' framing. Bottom line: treat as a genuine availability bug to patch during normal cycles, not an emergency, but verify whether the AdminServer port is exposed in your environment before deciding urgency - do not treat the 'unauthenticated' label as proof of remote reachability.

An attacker who can reach the OFBiz AdminServer control port uses the publicly known hard-coded credential to authenticate and issue a service-control (e.g. shutdown) command, terminating the application without any valid user account. No proof-of-concept is referenced in the available sources, and the exact command/trigger is not described. Exploitation hinges entirely on the admin control port being reachable from the attacker's position.