Apache OFBiz CVE-2026-97356

Exploitation targets the ViewFile component/endpoint of Apache OFBiz, where credentials are insufficiently protected, allowing an attacker to bypass authentication; the exact feature state or request required is not described in the available sources. The primary limiting factor confirmed by the evidence is version: only deployments running a release prior to 24.09.08 are affected, and upgrading to 24.09.08 is the vendor-stated remediation. Whether any non-default configuration, prior access level, or user interaction is needed is not stated - authentication requirements cannot be confirmed because no CVSS vector is provided.

Signal coverage for CVE-2026-97356 is thin: no CVSS vector, no EPSS score, no CISA KEV listing, and no public PoC are present in the input, and the vuln.today decision label is 'awaiting_data' - meaning the priority is not yet determinable from authoritative scoring, not that the issue is low-risk. The only substantive descriptor is the CVE title, 'Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass' (CWE-522-class), which indicates that weakly protected credentials in the ViewFile component let an attacker circumvent authentication - a class that, if network-reachable and unauthenticated, is typically high-impact. However, no official severity confirms this, and the exact trigger is not described in the available sources. The surrounding advisory bundles this with genuinely critical OFBiz flaws (e.g., CVE-2026-68524 pre-auth RCE, CVE-2026-105330 hard-coded JWT key granting unauthenticated admin), so the overall patch (24.09.08) is clearly important; but for THIS specific CVE the real-world risk cannot be ranked confidently until a CVSS vector or vendor advisory detail is published. Treat it as a probable authentication-bypass/credential-exposure issue pending vendor scoring, not as a confirmed-exploited emergency.

An attacker reaches the OFBiz ViewFile component and leverages credentials that are stored or transmitted with insufficient protection to bypass the authentication check, gaining access that should require a valid login. The precise request sequence is not described in the available sources, and no public exploit is identified at time of analysis.