{"id":"CVE-2021-26295","aliases":["EUVD-2021-13106","GHSA-hp7h-f9pw-x5wj"],"status":"published","title":"RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI","description":"Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.97822,"percentile":0.99907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-502"],"published":"2021-03-22T12:00:18Z","modified":"2026-10-24T10:30:54Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/apache_ofbiz_deserialization_soap","title":"Apache OFBiz SOAP Java Deserialization","type":"exploit","platform":"Linux,Unix","date":"2021-03-22","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/apache_ofbiz_deserialization_soap"},{"source":"nuclei","id":"CVE-2021-26295","title":"Apache OFBiz \u003c17.12.06 - Arbitrary Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26295.yaml"},{"source":"pocgithub","id":"coolyin001/CVE-2021-26295--","title":"coolyin001/CVE-2021-26295--","date":"2021-04-09","url":"https://github.com/coolyin001/CVE-2021-26295--"},{"source":"pocgithub","id":"dskho/CVE-2021-26295","title":"dskho/CVE-2021-26295","date":"2021-03-25","url":"https://github.com/dskho/CVE-2021-26295"},{"source":"pocgithub","id":"rakjong/CVE-2021-26295-Apache-OFBiz","title":"rakjong/CVE-2021-26295-Apache-OFBiz","date":"2021-03-24","url":"https://github.com/rakjong/CVE-2021-26295-Apache-OFBiz"},{"source":"pocgithub","id":"yuaneuro/ofbiz-poc","title":"yuaneuro/ofbiz-poc","date":"2021-05-13","url":"https://github.com/yuaneuro/ofbiz-poc"},{"source":"pocgithub","id":"yumusb/CVE-2021-26295","title":"yumusb/CVE-2021-26295","date":"2021-03-23","url":"https://github.com/yumusb/CVE-2021-26295"}],"products":[{"vendor":"apache","product":"ofbiz"},{"vendor":"apache software foundation","product":"apache ofbiz"}],"references":[{"url":"https://lists.apache.org/thread.html/r3c1802eaf34aa78a61b4e8e044c214bc94accbd28a11f3a276586a31%40%3Cuser.ofbiz.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix"]},{"url":"https://lists.apache.org/thread.html/r6e4579c4ebf7efeb462962e359501c6ca4045687f12212551df2d607%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0%40%3Cdev.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6%40%3Cdev.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a%40%3Cdev.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc9bd0d3d794dc370bc70585960841868cb29b92dcc80552b84ca2599%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://lists.apache.org/thread.html/rbe512e5ccd6b11169c6379daa1234bc805f3d53c5a38224e956295ce%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26295"},{"url":"https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661@%3Cnotifications.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0@%3Cdev.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d@%3Ccommits.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244@%3Cnotifications.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r6e4579c4ebf7efeb462962e359501c6ca4045687f12212551df2d607@%3Cnotifications.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735@%3Cnotifications.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rbe512e5ccd6b11169c6379daa1234bc805f3d53c5a38224e956295ce@%3Cnotifications.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d@%3Ccommits.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc9bd0d3d794dc370bc70585960841868cb29b92dcc80552b84ca2599@%3Cnotifications.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a@%3Cdev.ofbiz.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6@%3Cdev.ofbiz.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-hp7h-f9pw-x5wj"}],"sources":{"cve":[{"id":"CVE-2021-26295","title":"RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI","description":"Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.","status":"published","published":"2021-03-22T12:00:18Z","modified":"2025-02-13T16:27:51.958Z","updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-13106","description":"Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.","status":"published","published":"2021-03-22T12:00:18Z","modified":"2025-02-13T16:27:51Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-hp7h-f9pw-x5wj","title":"Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use...","description":"Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.","status":"published","published":"2022-05-24T17:45:01Z","modified":"2024-04-04T03:05:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:56:13.784244Z"}],"nvd":[{"id":"CVE-2021-26295","description":"Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.","status":"published","published":"2021-03-22T12:15:13.877Z","modified":"2026-06-17T03:43:04.18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"CVE-2021-26295","description":"Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.","status":"published","published":"2021-03-22T12:15:13.877Z","modified":"2026-10-24T10:30:54.718927139Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.778776Z"}]}}