CVE-2026-45434

CVE-2026-45434 is an improper authentication vulnerability (CWE-287) in Apache OFBiz, rooted in a flaw in the password-change logic that ultimately allows remote code execution. The CVSS vector indicates the flaw is exploitable over the network with no privileges or user interaction required, meaning unauthenticated attackers can trigger it against vulnerable OFBiz servers. A successful attacker gains full remote code execution on the affected server, with high impact to confidentiality, integrity, and availability. Any organization running Apache OFBiz before version 24.09.06 is affected, including internet-facing ERP and e-commerce deployments. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the high EPSS score (22.4% probability of exploitation within 30 days, 98th percentile) suggests exploitation is likely to follow.

What to do: Upgrade Apache OFBiz to version 24.09.06 immediately. If upgrading is not yet possible, restrict network access to the OFBiz server — especially the authentication and password-change endpoints — and verify authentication is enforced there. Monitor logs for unauthenticated password-change activity or unexpected process execution, since OFBiz has a history of exploited pre-auth RCE chains.