CVE-2026-83542: Critical RCE in Apache OFBiz 24.09

CVE-2026-83542 is a code injection vulnerability in Apache OFBiz versions 24.09 before 24.09.08. An unauthenticated remote attacker can exploit the widget XML multipart upload mechanism to override the mainDecoratorLocation parameter and force OFBiz to load malicious XML. During failed authentication page rendering, the server evaluates an unsandboxed Groovy expression, enabling remote code execution. The vulnerability is also reachable via the public /sfa/control/editPortalPageColumnWidth route, returning command output directly in HTTP 200 responses.

Exploitation does not require malformed requests: a well-formed multipart request kept in flight is sufficient. The screen loader reads widget XML from the live process file descriptor during streaming, not from disk-persisted files. With CVSS 9.8 (critical), this ranks among the most severe vulnerabilities: no authentication required, remote code execution, ease of exploitation. The patch is available in version 24.09.08. Social media signals (4 posts in the last 24 hours) confirm community awareness.

For defenders: upgrade Apache OFBiz to version 24.09.08 immediately. If immediate patching is not possible, isolate OFBiz instances from the internet or apply web application firewall rules to block unauthenticated access to the /sfa/control/editPortalPageColumnWidth path. Review logs for exploitation evidence: malicious multipart uploads and/or anonymous JSON requests to authentication routes. Monitor OFBiz processes for unexpected Groovy execution.