Apache OFBiz EUVD-2026-117479

Exploitation targets the OFBiz webtools 'viewdatafile' function, which accepts an attacker-supplied URL that the server fetches without filtering - the concrete prerequisite is the ability to invoke that specific webtools screen/request. The webtools component in OFBiz is an administrative/utility area that normally requires an authenticated session, so reaching this function is the primary limiting factor; however, because no CVSS vector was published, the exact privilege level required is not confirmed from the available data. Further limits: realistic impact depends on whether OFBiz can reach valuable internal/metadata endpoints from its network position and whether the fetched response is reflected back to the caller, which the sources do not detail.

This is CVE-2026-82902, a server-side request forgery (SSRF) issue described as an 'unfiltered server-side URL fetch in webtools viewdatafile' within Apache OFBiz, disclosed as one of 40+ vulnerabilities in a single batch advisory. Critically, almost every real-world risk signal is MISSING: no CVSS vector or score is published (input shows CVSS: N/A), no EPSS probability is provided, there is no CISA KEV listing, and the vuln.today Decision label is explicitly 'awaiting_data' - meaning the prioritization framework itself has not reached a verdict. No SSVC exploitation/automatable/impact values are available. Because of this, severity cannot be anchored to any vendor- or NVD-confirmed metric and is INFERRED only from the vulnerability title. On mechanism alone, SSRF in an administrative utility (webtools) is typically a medium-severity, authentication-gated issue rather than a drop-everything emergency - but this cannot be stated as fact without the CVSS vector. Note that other CVEs in the same advisory are explicitly labeled pre-authentication RCE (e.g. CVE-2026-68524, CVE-2026-83542); those, not this SSRF, are the likely real priorities of the bundle. Treat this specific CVE as awaiting-data: patch via the single cumulative upgrade, but do not represent its individual risk as confirmed-high absent the missing scoring data.

An actor with access to the OFBiz webtools 'viewdatafile' function supplies a URL that the server fetches without validation, causing OFBiz to issue requests to internal services, cloud metadata endpoints, or other back-end systems and return their responses. This enables reconnaissance and disclosure of resources not otherwise reachable from outside. No public exploit has been identified for this CVE; the only references are the oss-security announcement and the vendor advisory.