CVE-2026-83542
Apache OFBiz unauthenticated code execution through login-page and portal widget injection; public PoC
Reachable if an OFBiz instance runs a release before 24.09.08 and an untrusted network can reach /sfa/control/editPortalPageColumnWidth or a manager login page without logging in
CVE-2026-83542 lets an attacker who hasn't logged in run code on an Apache OFBiz server. NVD's description says it "allows a remote unauthenticated attacker to execute arbitrary code on the server." The fix is OFBiz 24.09.08, released with a batch of OFBiz CVEs Apache announced on November 4, so one upgrade also closes companions such as CVE-2026-68524 and CVE-2026-82907.
There are two ways in, and both need checking. The original report used a manager login route, where the payload runs while OFBiz renders the login-failure page. NVD adds that the same issue "is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response." CISA-ADP scores it 9.8. CryptoCat has published a working proof of concept; nobody has reported exploitation, and it is not on CISA's KEV.
- Vendor
- Apache Software Foundation
- Product
- Apache OFBiz
- Affected versions
- "All versions prior to 24.09.08" (Apache announcement); NVD's description names "Apache OFBiz 24.09 before 24.09.08"
- Vulnerable component
- OFBiz screen widget rendering; anonymous JSON override of mainDecoratorLocation on manager login routes and /sfa/control/editPortalPageColumnWidth
- CVSS
- 9.8 (CISA-ADP, CVSS 3.1); Apache's CNA record carries no score and NVD has not added its own
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CISA-ADP)
- CWE
- CWE-94 Code Injection (Apache)
- Exploitation
- Not observed
- CISA KEV added
- Patch
- Apache OFBiz 24.09.08, which also fixes the other CVEs in Apache's November 4 announcement, including CVE-2026-68524 and CVE-2026-82907
Is it reachable for you?
How it works. Per NVD (Apache's text), an attacker stages "crafted widget XML in a multipart upload" and overrides "the mainDecoratorLocation used by a manager login route through an anonymous JSON request." OFBiz then loads the staged XML "through its live screen descriptor mechanism" and evaluates "an unsandboxed Groovy expression" while rendering the page. NVD says the upload doesn't need to be malformed and is read "from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk." CryptoCat says the payload "runs with the OFBiz process's authority, including access to its database credentials and network position."
What's affected. Apache's security page says "affected releases before 24.09.08; fixed in 24.09.08 with PRs #1654 and #1653." Apache's oss-security announcement says "Affected versions: All versions prior to 24.09.08." NVD's description names "Apache OFBiz 24.09 before 24.09.08." Apache names no fixed build other than 24.09.08, and we have not confirmed whether older lines such as 18.12 contain this code path.
The test. An instance is reachable if it runs a release before 24.09.08 and an untrusted network can send requests to an OFBiz manager application without logging in.
- Check the version. Find which OFBiz release each instance was built from. Anything before 24.09.08 is in scope per Apache.
- Check the public portal route. See whether
/sfa/control/editPortalPageColumnWidthanswers from outside your trusted network. NVD says it returns command output directly, and it doesn't depend on a login page. - Check the login pages. See whether manager applications, such as Order Manager at
/ordermgr/control/mainin CryptoCat's example, show their login page to anonymous users from untrusted networks. Blocking one path leaves the other open. - Check every way in. From outside your network, list each hostname, port, reverse proxy and load balancer that forwards to OFBiz.
Same build, other fixes. Apache's security page lists many CVEs as fixed in 24.09.08, including CVE-2026-68524 ("Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading") and CVE-2026-82907 ("externalLoginKey honoured pre-auth, reusable and unbound," 9.8 from CISA-ADP). One upgrade closes them all.
Quell checks whether an OFBiz instance below 24.09.08 exposes /sfa/control/editPortalPageColumnWidth or a manager login page to networks attackers can reach, across every system you run. See how Quell works
Compensating controls (test them, don't assume them)
Apache publishes no workaround. Its only stated mitigation is "Users are advised to upgrade to Apache OFBiz 24.09.08."
- Exploitation. CryptoCat notes that "An intermediary that buffers every body before forwarding defeats this particular staging method." This only helps against that one staging method, not the underlying issue NVD describes.
The patch is the only fix. Upgrade to OFBiz 24.09.08.
What to look for in logs
Apache and CISA publish no indicators for CVE-2026-83542. Hunting leads, not confirmed indicators, are anonymous requests to /sfa/control/editPortalPageColumnWidth and unusually large multipart uploads held open to manager routes in web server and proxy logs.
How Tuskira helps
Tuskira is an agentic cyber defense platform that connects to the 200+ security and IT tools you already run. When a new critical vulnerability lands, Tuskira answers three questions.
Is there a reachable path? For example, whether an OFBiz instance below 24.09.08 exposes /sfa/control/editPortalPageColumnWidth or a manager login page to networks attackers can reach.
Would your controls stop it? Tuskira tests the controls you already run, such as your WAF, firewall rules and EDR, against the path.
Can you close the gap now? Quell stages the compensating control change through your existing tools, with your approval, then re-tests to confirm the path is closed.
The vendor patch is the complete fix. Quell reduces exposure and proves your controls work in the meantime.
See how Quell handles emerging threatsFAQ
Am I exposed to CVE-2026-83542?
Yes, if an OFBiz instance runs a release before 24.09.08 and untrusted networks can reach its manager applications, through either the SFA portal route or a manager login page.
Is CVE-2026-83542 being exploited?
No exploitation has been reported, and it is not on CISA KEV as of November 6, 2026. CryptoCat has published a working proof of concept.
Do I need to log in for this to work?
No. NVD says "a remote unauthenticated attacker" can exploit it.
Is blocking the SFA portal URL enough?
No. NVD says the issue is also reachable through manager login pages.
Are older OFBiz releases such as 18.12 affected?
Apache's announcement says "All versions prior to 24.09.08," while NVD names only the 24.09 line. Apache names no fix other than 24.09.08, so upgrade to it.
Updates
Nov 6, 2026. First published. Public proof of concept from CryptoCat; no exploitation reported; not on CISA KEV.
Sources
- Apache OFBiz security page
- Apache OFBiz CVE announcements, oss-security (Nov 4, 2026)
- NIST NVD: CVE-2026-83542 (checked Nov 6), CVE-2026-68524 and CVE-2026-82907
- CryptoCat research and proof of concept (read only, not run)
- Apache OFBiz downloads
- CISA Known Exploited Vulnerabilities catalog (checked Nov 6)
We publish an advisory when a vulnerability is Critical or on CISA KEV, has one identifiable component to check, and has a public proof of concept or reported exploitation. Advisories are updated as exploitation status changes.