What is the CVSS score of EUVD-2026-36167?

EUVD-2026-36167 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apache OFBiz are affected by EUVD-2026-36167?

Apache OFBiz, an enterprise resource planning system for supply chain and content management, contains CVE-2026-50223, which allows authenticated users with editing privileges to execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-36167?

24 hours: Inventory all Apache OFBiz deployments and identify instances running versions before 24.09.07. 7 days: Deploy OFBiz 24.09.07 to all production environments and validate functionality before release to business users. 30 days: Complete deployment to all development and non-production instances; audit Content and DataResource privilege assignments to align with least-privilege access principles.

Apache OFBiz EUVD-2026-36167

| CVE-2026-50223 HIGH

Code Injection (CWE-94)

2026-06-10

GHSA-862q-5rrg-cc9p

RCE Apache Code Injection Ofbiz

8.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web app (AV:N), no special timing or config (AC:L), requires an authenticated content-editor role (PR:L), no victim interaction (UI:N), full RCE on the JVM yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 11, 2026 - 16:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 11, 2026 - 16:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 11, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jun 11, 2026 - 16:22 NVD

8.8 (HIGH)

Patch available

Jun 11, 2026 - 02:00 EUVD

Analysis Generated

Jun 10, 2026 - 18:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 2

News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News Critical RCE in Apache OFBiz via FreeMarker SSTI - CVE-2026-50223 Jun 10, 2026

AnalysisAI

Server-side template injection in Apache OFBiz before 24.09.07 allows authenticated users holding Content or DataResource editing privileges to inject template code that is rendered by the framework, resulting in remote code execution on the application server. The flaw is rated CVSS 8.8 with publicly available exploit code exists via the oss-security disclosure thread, though EPSS sits at 0.09% (26th percentile), indicating broad opportunistic exploitation has not yet been observed. Apache has shipped a fix in 24.09.07 and recommends immediate upgrade.

Technical ContextAI

Apache OFBiz is an open-source enterprise resource planning (ERP) and e-commerce suite built on Java that uses an internal templating engine (FreeMarker/Groovy-based screen and form widgets) to render Content and DataResource entities. The Content/DataResource subsystem stores user-editable templates in the database and renders them through the framework's screen renderer, which historically has been a recurring attack surface in OFBiz (CVE-2023-49070, CVE-2023-51467, CVE-2024-45195 all involved similar template/script execution paths). CWE-94 (Improper Control of Generation of Code) here means input supplied through Content or DataResource editing screens is incorporated into a template that is later evaluated server-side without sufficient sandboxing, allowing FreeMarker or Groovy directives to break out and reach the underlying JVM.

RemediationAI

Vendor-released patch: Apache OFBiz 24.09.07 - upgrade immediately following the migration guidance at https://ofbiz.apache.org/ and the announcement thread https://lists.apache.org/thread/trr2p4zokg54glqlhjnglt4yr7n8t5xd. If an upgrade cannot be applied immediately, restrict Content and DataResource editing privileges to a minimal, trusted set of accounts through OFBiz's security group permissions (revoke CONTENTMGR_CREATE/UPDATE and DATARESOURCE_CREATE/UPDATE from non-essential roles), disable any self-service or default seed users that may carry these permissions, and place the OFBiz web tier behind a reverse proxy that blocks access to /content, /contentmgr, and /webtools template editing endpoints from the Internet - accepting that this will break legitimate content editing workflows for blocked users. Monitor application logs for unusual FreeMarker/Groovy error traces from the screen renderer as a detection compensating control.