What is the CVSS score of EUVD-2026-30872?

EUVD-2026-30872 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30872?

Yes, a patch is available for EUVD-2026-30872. Update the affected software to the latest version immediately.

Apache OFBiz EUVD-2026-30872

| CVE-2026-35086 MEDIUM

Code Injection (CWE-94)

2026-05-19 apache

GHSA-5gfp-86vp-f9mf

RCE Apache Code Injection Apache Ofbiz Apache Software Foundation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable email service requires no auth; integrity raised to High because code injection by definition enables arbitrary alteration of application logic and data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:52 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:36 cve.org

MEDIUM 6.5

CVE Published

May 19, 2026 - 09:36 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Code injection in Apache OFBiz's email services exposes all versions before 24.09.06 to unauthenticated remote exploitation via CWE-94. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and SSVC classifies the attack as automatable - meaning it can be scripted at scale. Despite the RCE tag attached by intelligence sources, CVSS impact metrics are capped at C:L/I:L/A:N and EPSS sits at 0.03% (8th percentile), indicating no public exploitation observed at time of analysis and no CISA KEV listing.

Technical ContextAI

Apache OFBiz is an open-source Java-based enterprise resource planning (ERP) platform. The flaw is classified as CWE-94 (Improper Control of Code Generation), a root cause where attacker-supplied input reaches a code-generation or template-evaluation layer without sufficient sanitization, resulting in execution of injected instructions. The vulnerable surface is specifically the email services subsystem, which commonly involves template engines (e.g., Freemarker, Groovy scripting) used to render dynamic email bodies. CPE data (cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:*) confirms the entire pre-24.09.06 release lineage is affected. The unchanged scope (S:U) in the CVSS vector indicates exploitation is contained within the OFBiz application boundary.

RemediationAI

Vendor-released patch: 24.09.06. Organizations should upgrade Apache OFBiz to version 24.09.06 or later immediately, as confirmed by the Apache advisory at https://lists.apache.org/thread/g0s37yhnh2xwfts400crb2w8s337hgjx. If an immediate upgrade is not feasible, restrict external network access to all OFBiz email service endpoints at the perimeter firewall or reverse proxy layer - note this will disable outbound email functionality until patching is complete. Additionally, deploy a WAF rule to inspect and block requests containing template expression syntax (e.g., Freemarker ${...} or Groovy script markers) targeting OFBiz email routes as a partial compensating control, accepting the trade-off that pattern matching may produce false positives. Further technical context is available from the oss-security post at http://www.openwall.com/lists/oss-security/2026/05/19/26.