What’s Vulnerable › Vulnerabilities

CVE-2025-54466: Apache OFBiz: RCE Vulnerability in scrum plugin

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 26.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-15 · updated 2026-06-17
• Weakness: CWE-94

Description

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.

Affected products

• Apache Software Foundation Apache OFBiz: before 24.09.02 — fixed in 24.09.02

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OFBiz 24.09.02. Check the vendor advisory for mitigations.

References

• https://issues.apache.org/jira/browse/OFBIZ-13276
• https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915
• https://ofbiz.apache.org/download.html
• https://ofbiz.apache.org/release-notes-24.09.02.html
• https://ofbiz.apache.org/security.html
• http://www.openwall.com/lists/oss-security/2025/08/05/1

Get alerted when CVE-2025-54466 or the next vulnerability affects your stack