CVE-2023-49070: Apache OFBiz pre-auth remote code execution via legacy XML-RPC
The short version: Apache OFBiz shipped with a no-longer-maintained XML-RPC component still present in the code, and that leftover (CVE-2023-49070) gives an unauthenticated attacker a path to remote code execution on the server. Upgrade to 18.12.10 or later. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE in an ERP platform |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~95.44% · 99.86th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not listed in KEV; public analysis and tooling exist |
| Vulnerability type | CWE-94 code injection (via legacy XML-RPC) → pre-authentication remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Apache OFBiz before 18.12.10 |
| Fixed in | Apache OFBiz 18.12.10 |
What you need to know
Apache OFBiz is a business platform — ERP, e-commerce, CRM. CVE-2023-49070 comes from an XML-RPC component that was no longer maintained but was still present and reachable in the code base. An unauthenticated attacker can abuse it to execute code on the server, no valid credentials required.
Why it matters:
- It's pre-authentication. The vulnerable path doesn't need a login, and OFBiz endpoints are frequently internet-facing.
- The target is an ERP. Code execution here reaches the systems that run core business operations, not a single isolated host.
- Dead code is still live code. An unmaintained component left in place is exactly the kind of forgotten surface attackers look for.
How serious we see it
High — a critical-class flaw we rate by the full picture.
Mechanically it's a 9.8: unauthenticated, network-reachable remote code execution. We rate it High rather than Critical because it isn't in CISA's KEV catalog — we reserve "Critical" for flaws with confirmed, KEV-level exploitation. The impact is still severe, so it belongs near the top of the queue. The reassuring part is that the fix removed the legacy component, one upgrade closes it, and your exposure is quick to determine.
A note on KEV status: our internal library initially flagged this as KEV-listed. On verification against CISA's current catalog, CVE-2023-49070 is not present — though several closely related OFBiz authorization/RCE flaws are. We've reflected CISA's authoritative status above.
Recommendations
Straight from the Apache OFBiz security advisory:
- Patch now. Upgrade to Apache OFBiz 18.12.10 or later (18.12.16 addresses this and later OFBiz fixes).
- Restrict access. Limit the OFBiz application to trusted networks until you've patched.
- Hunt for prior use. Review application logs for anomalous requests to XML-RPC and other unauthenticated endpoints.
- If you find indicators, respond. Rotate credentials and secrets reachable from the server.
- Confirm your exposure first. Verify whether you run an internet-facing OFBiz instance below 18.12.10.
How BreachRisk sees it
BreachRisk discovers internet-facing OFBiz instances from little more than your domain, fingerprints the version, and flags exposure tied to this CVE. An unauthenticated RCE in a business platform is the kind of finding BreachRisk pushes up your results, so it doesn't get lost in a scanner backlog.
That continuous, outside-in view means an exposed OFBiz server is already mapped, so you can go straight to patch-and-verify.