Vulnerability record · CVE-2021-26295 · published 22 March 2021
CVE-2021-26295: Apache OFBiz unsafe deserialization allows unauthenticated takeover
Apache · Ofbiz
Apache OFBiz before 17.12.06 performs unsafe deserialization of untrusted data, matching CWE-502. An unauthenticated attacker can exploit this to take over the application. With a CVSS 3.1 base score of 9.8 and an EPSS 30-day probability near 0.98, this is a high-urgency remote code execution class flaw.
Description
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required, near-maximum EPSS, and public exploit code make this an urgent remote takeover risk.
What it is
Apache OFBiz before 17.12.06 performs unsafe deserialization of untrusted data, matching CWE-502. An unauthenticated attacker can exploit this to take over the application. With a CVSS 3.1 base score of 9.8 and an EPSS 30-day probability near 0.98, this is a high-urgency remote code execution class flaw.
Impact
Successful exploitation gives the attacker full control of the Apache OFBiz instance, consistent with the CVSS impact ratings of high confidentiality, integrity and availability. This can lead to data theft, tampering and service disruption.
Attack surface
The flaw is network-reachable with no privileges and no user interaction required (AV:N/AC:L/PR:N/UI:N). Public exploit material references a SOAP/Java deserialization path, indicating the attack is delivered over the exposed service interface.
Exploitation
CISA KEV does not list this CVE, but EPSS is 0.97822 (99.9th percentile) and public references are tagged Exploit, indicating working exploit code is available. No ransomware group is documented as using it in this record.
What to do
- Upgrade Apache OFBiz to 17.12.06 or later; this is the primary fix.
- If immediate upgrade is not possible, restrict network access to OFBiz endpoints to trusted hosts only.
- Disable or block unnecessary SOAP/deserialization-exposing interfaces until patched.
- Monitor vendor and Apache mailing list advisories for the official patch guidance.
- Treat any internet-facing OFBiz instance as high risk and prioritize it for remediation.
Detection
- Inspect web and application logs for SOAP requests containing serialized Java objects or unusual content types.
- Alert on unexpected child processes or command execution spawned by the OFBiz Java process.
- Monitor for outbound connections from OFBiz hosts to unfamiliar external addresses.
- Review OFBiz access logs for anomalous request patterns from unauthenticated sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-26295 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-26295), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
