# CVE-2026-83542

Unauthenticated RCE in Apache OFBiz via crafted widget XML.

- Page: https://www.vulneraibility.com/cve/CVE-2026-83542
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-11-05)
- Weakness: CWE-94
- Published: 2026-11-05

## Affected versions

- Apache Software Foundation Apache OFBiz: affected < 24.09.08

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated remote code execution (CWE-94) allowing arbitrary Groovy code and OS command execution, and command output disclosure via HTTP.

## Action

Immediate action required

## Recommendation

Upgrade to OFBiz 24.09.08 immediately; restrict admin endpoints and monitor logs.

## References

- [advisory] https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.