Apache OFBiz EUVD-2026-36167

Exploitation requires (1) network reachability to the OFBiz web tier, (2) valid credentials for an authenticated OFBiz account, and (3) that account must hold Content or DataResource editing privileges (the CONTENTMGR/DATARESOURCE create-or-update permissions in OFBiz security groups) - anonymous browsing users and accounts limited to ecommerce checkout, order viewing, or other non-content roles cannot trigger the flaw. No user interaction by another party is required (UI:N) and the attack works against default-configuration OFBiz instances prior to 24.09.07; the chief limiting factor is the privileged role requirement, which is meaningful for hardened internal deployments but trivially satisfied where content editor accounts are widely provisioned or where weak/default credentials persist.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a network-reachable, low-complexity attack that requires an authenticated account with the specific Content/DataResource editing role - not anonymous access. EPSS of 0.09% (26th percentile) is low and the CVE is not on CISA KEV, suggesting no observed mass exploitation yet, but this signal lags reality and OFBiz has a strong history of post-disclosure exploitation (multiple prior OFBiz RCEs were rapidly weaponized and added to KEV). Real-world risk is high for any Internet-exposed OFBiz instance where Content editor accounts can be obtained through weak credentials, default accounts, or self-registration flows; risk is materially lower for hardened, internal-only deployments with tight RBAC. Note that PR:L combined with the description's 'Content/DataResource editing privileges' indicates a privileged-but-common business role rather than admin, so treat any reachable instance as a priority patch target.

An attacker obtains low-privileged credentials for an OFBiz account that carries Content or DataResource editing rights - for example through credential stuffing against an Internet-exposed instance, a phishing-stolen content editor account, or a default/weak seed account left over from initial deployment. The attacker authenticates to the Content Manager, creates or modifies a Content/DataResource record whose body contains a malicious FreeMarker or Groovy directive, then triggers rendering of that record to execute arbitrary commands as the OFBiz JVM user, pivoting to database credentials and lateral movement; publicly available exploit code exists via the oss-security disclosure.