PT-2026-41855 · Apache · Apache Ofbiz

Published 2026-05-19 · Updated 2026-05-21 · CVE-2026-31986

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.06

Description Apache OFBiz contains a hard-coded cryptographic key. This flaw may allow remote attackers to gain unauthorized access, expose sensitive data, or tamper with application data.

Recommendations Upgrade to version 24.09.06.

Fix

RCE

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2026-31986

Affected Products

Apache Ofbiz

References · 7

• https://lists.apache.org/thread/2hl9xoqm8tq8b22x6vnmtp7tg3opcqgc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31986 · Security Note
• https://twitter.com/ADKCyber/status/2056886461673472329 · Twitter Post
• https://twitter.com/UpwindMDR/status/2056868904153350595 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/19/25 · Note
• https://t.me/CVEtracker/54220 · Telegram Post
• https://twitter.com/SelvaKtm2/status/2057469297262547441 · Twitter Post