CVE-2024-38856: Apache OFBiz authorization bypass to remote code execution, actively exploited
The short version: Apache OFBiz has an incorrect-authorization flaw (CVE-2024-38856) that lets an unauthenticated attacker slip past permission checks to reach screen-rendering code, opening a path to remote code execution. It's in CISA's KEV catalog, there are public exploits, and CISA has warned of active exploitation. Patch to 18.12.15 or later. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, actively exploited |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.43% · 99.94th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-09-17 |
| Known exploited? | Yes — public proof-of-concept; CISA warned of active exploitation |
| Vulnerability type | CWE-863 incorrect authorization → unauthenticated access to screen rendering → remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Apache OFBiz through 18.12.14 |
| Fixed in | Apache OFBiz 18.12.15 |
What you need to know
Apache OFBiz is a business platform — ERP, e-commerce, CRM. CVE-2024-38856 is an incorrect-authorization flaw: some screen definitions rely on how their endpoints are configured rather than checking the user's permissions directly. That gap lets an unauthenticated attacker reach screen-rendering code they shouldn't, and from there execute code on the server.
Why it's top-of-queue:
- It's pre-authentication and internet-reachable. No login, and OFBiz endpoints are commonly exposed.
- It's already operational. Public proof-of-concept code exists, and CISA has flagged active exploitation — this is not theoretical.
- The target is an ERP. Code execution reaches the systems running core business operations.
How serious we see it
High — in practice and on paper.
Unauthenticated, network-reachable remote code execution in a business platform, confirmed exploited and listed in KEV, is the definition of top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects OFBiz through 18.12.14, the fix is published, and exposure is quick to determine. The catch is the same as any exploited-before-you-patched flaw — being patched and being clean are separate questions.
Recommendations
Straight from the Apache OFBiz security advisory and CISA:
- Patch now. Upgrade to Apache OFBiz 18.12.15 or later (18.12.16 also carries later fixes).
- Restrict access. Limit the OFBiz application to trusted networks until you've patched.
- Hunt for prior use. Review application logs for anomalous requests to unauthenticated endpoints and screen-rendering paths.
- If you find indicators, respond. Rotate credentials and secrets reachable from the server and investigate for lateral movement.
- Confirm your exposure first. Verify whether you run an internet-facing OFBiz instance through 18.12.14.
How BreachRisk sees it
BreachRisk discovers internet-facing OFBiz instances from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, attacker's-eye view is the point: when an OFBiz RCE is being exploited in the wild, the exposed server is already mapped, so you can go straight to patch-and-verify.