CVE-2023-49070: Apache OFBiz pre-auth RCE via legacy XML-RPC code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with a CVSS of 9.8 and very high EPSS probability makes this an urgent patch-first issue for any exposed OFBiz instance.

What it is

Apache OFBiz before 18.12.10 ships a deprecated XML-RPC endpoint that allows code injection, resulting in remote code execution without authentication. The flaw is rated critical (CVSS 9.8) and affects internet-facing OFBiz deployments, which are commonly exposed for e-commerce and ERP functions.

Impact

An unauthenticated attacker can execute arbitrary code on the OFBiz server, leading to full compromise of the application and its data. This can enable data theft, persistence, and lateral movement into connected systems.

Attack surface

Reachable over the network via the XML-RPC interface; the CVSS vector shows no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N). Any OFBiz instance exposing the affected endpoint is directly attackable.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.95368, 99.864th percentile) and public exploit code exists (Packet Storm reference), indicating active exploitation is likely.

What to do

• Upgrade Apache OFBiz to 18.12.10 or later immediately.
• If upgrade is not possible, disable or block access to the XML-RPC endpoint at the network or reverse-proxy layer.
• Restrict internet exposure of OFBiz management and RPC interfaces to trusted networks only.
• Monitor vendor advisories and apply any follow-up patches for related OFBiz issues.
• Review server logs for signs of compromise and rotate credentials if exploitation is suspected.

Detection

• Inspect web server and OFBiz logs for POST requests to XML-RPC paths, especially from unexpected source IPs.
• Alert on outbound network connections or process creation from the OFBiz service account that are not typical for the application.
• Use the public Packet Storm exploit details to create signatures or YARA/Suricata rules for known payload patterns.
• Monitor for unexpected file writes or new processes spawned by the Java process hosting OFBiz.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.