Apache OFBiz EUVD-2026-30852

The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation with no user interaction against any network-reachable Apache OFBiz instance running a version prior to 24.09.06. No non-default configuration or special deployment mode is indicated - default OFBiz installations appear vulnerable. Exploitation is limited by OS-level filesystem permissions assigned to the OFBiz service process, meaning attackers can only access files readable or writable by that account. Environments that run OFBiz behind a WAF with path traversal filtering, isolate it from the public internet, or restrict the service account to minimal filesystem access face materially reduced exposure even before patching.

The raw CVSS score of 6.5 with an unauthenticated network vector (AV:N/AC:L/PR:N/UI:N) appears concerning, but the composite threat picture is considerably calmer. EPSS at 0.02% (6th percentile) reflects very low empirical exploitation probability, there is no CISA KEV listing, and SSVC confirms exploitation status as 'none' with only partial technical impact. The key tension is SSVC's 'Automatable: yes' flag - if reliable exploit code surfaces, internet-scanning campaigns against OFBiz could scale rapidly given the unauthenticated vector. Impact is bounded by C:L/I:L/A:N, meaning attackers gain partial file read/write constrained by the OS process permissions of the OFBiz service account, not full code execution. This is a genuine vulnerability requiring timely patching but does not represent an immediate emergency given the absence of active exploitation signals or public exploit code.

An unauthenticated attacker sends a crafted HTTP GET request to a publicly accessible Apache OFBiz endpoint with path traversal sequences embedded in a URL parameter or resource path, causing the server to resolve and return a file outside the application webroot - such as configuration files containing database credentials or internal API keys. No public exploit code has been identified at time of analysis, but the SSVC 'Automatable: yes' classification means automated scanning tools could probe large numbers of internet-exposed OFBiz deployments at scale once attack patterns are documented.