Hard-coded Password Vulnerability in Apache OFBiz AdminServer Component

CVE-2026-97355

What is CVE-2026-97355?

The AdminServer component in Apache OFBiz 24.09.07 is vulnerable due to the use of a hard-coded password, which can be exploited by an attacker who gains access to the AdminServer control port. This vulnerability allows the attacker to query the server’s running state and execute an unauthenticated shutdown of the instance using the default control key included in the configuration file. To mitigate this issue, users are strongly advised to upgrade to version 24.09.08, which resolves this security concern.

References