CVE-2021-26295

PoC —

CVSS 3.1

9.8 critical

EPSS

98%p100

Published

Mar 22, 2021 (Mar 22, 2021)

Modified

Jun 17, 2026

Description

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Vendors: apache
Products: ofbiz
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (97.8%)

In the news2 stories

Critical RCE Vulnerability Found in Apache OFBiz ERP Software—Patch Now

The Hacker NewsMar 22, 08:34 UTC · Mar 22, 2021Vulnerability CVE-2021-26295

RCE flaw in Apache OFBiz could allow to take over the ERP system

Security AffairsMar 22, 09:46 UTC · Mar 22, 2021Vulnerability CVE-2021-26295