CVE-2026-97355: Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service

Published Nov 5, 2026

Updated

Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OFBiz to a version that resolves this vulnerability.
Fixed in 24.09.08

Event History

Nov 5, 2026

CVE Published

via MITRE·01:45 PM

Data Sourced

via MITRE·01:45 PM

DescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache OFBiz 24.09.07 deployments are exposed if an attacker can reach the AdminServer control port. The issue applies on all platforms.

What does an attacker need to exploit the vulnerability?

The attacker only needs network reachability to the AdminServer control port. The fixed default control key in start.properties permits querying server state and triggering a shutdown without authentication.

Is there a fixed version available?

Yes. Upgrade Apache OFBiz to version 24.09.08, which fixes the issue.

CVE-2026-97355: Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is there a fixed version available?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is there a fixed version available?