Apache OFBiz maintainers fixed 46 flaws, The Hacker News reports, including CVE-2026-68524 (pre-auth remote code execution) and CVE-2026-109928 (full account takeover from a bad auth algorithm). Patched in OFBiz 24.09.08.
Why CVE-2026-68524 hurts
Advisory write-ups say an unauthenticated attacker can influence screen XML loading (including via a file: URI path) before login and reach code execution. If you expose OFBiz, this is not a “next sprint” patch.
My take
ERP boxes on the internet are candy. Upgrade to 24.09.08, lock admin paths down, and assume scanners already have the CVE string.
Review before you install: read the release notes yourself, back up your config, and try new versions somewhere you can afford to break first.
God Bless, and Happy hacking!
