← CVE Radar
CVE-2026-68524Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
EPSS 0.21%Not in KEVNVD: Awaiting Analysis
Overview
Severity
No CVSS score has been published for CVE-2026-68524 yet.
Details
- CVE ID
- CVE-2026-68524
- Status
- Awaiting Analysis
- Assigner (CNA)
- apache
- Published
- Nov 5, 2026
- Last modified
- 2026-11-06 21:36 UTC
- Weaknesses
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
Affected Products
As published by the CNA in the CVE record.
Apache Software FoundationApache OFBiz1 version range
- before 24.09.08