Apache OFBiz 24.09.08 fixes 46 flaws, and every earlier release is hit

Apache OFBiz 24.09.08 fixes 46 flaws, and every earlier release is hit

6 November 2026: Apache OFBiz 24.09.08 fixes 46 CVEs that the project lists as affecting all releases before it, and Italy's national cyber agency counts seven critical and 21 high severity among them. The flaw types include authentication bypass, arbitrary file read and write and remote code execution, so anyone running this open source ERP on an earlier release should treat the upgrade as urgent.

Not yet independently verified. The severity totals are from Italy's ACN, not Apache, and the project's announcement thread would not load as text. Apache gives the release only as November 2026, and we do not have a rating for each CVE. We will update this when it can be confirmed, and remove this note.

A single release with an unusually long list

The project's security page runs from CVE-2026-66903 to CVE-2026-114277, each entry tied to a pull request and marked in the same way: affected releases before 24.09.08, fixed in 24.09.08. The download page calls it the eighth release of the 24.09 series, released in November 2026.

Forty-six CVEs is a long list for one point release, and the project does not say how they came to light. ACN's bulletin, dated 6 November, also lists privilege escalation and spoofing among the types, and it shows none flagged as exploited.

Why an ERP raises the stakes

OFBiz handles orders, accounting, inventory and customer records in one application, often with a web storefront or partner portal on the same deployment. That makes the authentication bypass and code execution entries the ones to read first. A successful attack could reach financial and customer data together, rather than one department's system.

The security page ties every entry to the same fix and offers no backport. Sites on the older 18.12 or 17.12 lines are not on a fixed branch, so for them this is a migration project rather than a patch. Those teams should plan one and, in the meantime, keep the application behind a VPN or an allowlist.

Customised installs will take longer

OFBiz is a framework as much as a product, and many installations carry local changes to its components and screens. A customised site cannot assume the upgrade is a simple swap. It should diff local changes against the 24.09.08 pull requests, test order and invoicing flows on a copy, and then schedule the move.

Integrators who run OFBiz for clients should tell those clients now. Self-hosted open source has no vendor sending customers a notice, so a business that had its ERP built some years ago may not hear about this any other way. Any instance visible from the internet should have its logs checked for unfamiliar administrative sessions and unexpected files.

Our enterprise resource planning software category lists eleven products for teams weighing a move away.

Sources

• Apache OFBiz: Security page (no date on page, read 7 November 2026), 7 November 2026
• Apache OFBiz: Downloads, release 24.09.08, November 2026 (read 7 November 2026), 7 November 2026
• ACN (Italy's national cybersecurity agency): Vulnerabilities fixed in Apache OFBiz, AL04/261106/CSIRT-ITA, 6 November 2026, 6 November 2026