CVE-2026-97355
Awaiting Analysis Awaiting Analysis - Queue

Hard-coded Password in Apache OFBiz AdminServer

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-97355
EUVD
EUVD-2026-117464

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a hard-coded password issue in Apache OFBiz 24.09.07. The AdminServer component has a default control key in start.properties that allows unauthenticated shutdown of the server if an attacker can access the AdminServer control port. The vulnerability lets attackers query the server's state and trigger a shutdown without credentials.

Detection Guidance

Check if Apache OFBiz 24.09.07 is running by verifying the version in use. Inspect the start.properties file for the hard-coded default control key used by AdminServer. Monitor network traffic for unauthorized shutdown commands targeting the AdminServer control port.

Impact Analysis

An attacker could exploit this to shut down the Apache OFBiz instance remotely without authentication. This could disrupt services, cause downtime, or lead to denial-of-service conditions for users relying on the system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to the AdminServer component, which may lead to data exposure or service disruption. Unauthenticated shutdowns could interfere with system availability, a key requirement under both regulations.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to address the hard-coded password issue. Ensure the AdminServer control port is not exposed to untrusted networks. Rotate any credentials that may have been exposed due to this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...