Is CVE-2026-50223 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50223 being exploited in the wild.

How severe is CVE-2026-50223?

Informational severity, with a CVSS score of 8.8, published 10 June 2026.

Is there a fix for CVE-2026-50223?

A patch was published on 2026-06-10: Fixed in version 24.09.07 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50223 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50223?

Check whether you run Apache OFBiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50223: Apache OFBiz template injection in DataResource component

CVE-2026-50223 · Severity: info · CVSS 8.8 · Published 2026-06-10

Apache OFBiz, an open-source enterprise resource planning (ERP) suite, contains a security flaw that allows certain authorized users to execute unauthorized commands on the server. An attacker with basic permissions to edit content or data resources can exploit this to take full control of the application and its underlying data. This could lead to a total compromise of business operations and sensitive corporate information.

Technologies: Apache OFBiz. Vendors: Apache.

Quick answers

Is CVE-2026-50223 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50223 being exploited in the wild.
How severe is CVE-2026-50223?: Informational severity, with a CVSS score of 8.8, published 10 June 2026.
Which products and versions are affected?: Apache OFBiz before 24.09.07.
Is there a fix for CVE-2026-50223?: A patch was published on 2026-06-10: Fixed in version 24.09.07 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50223 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50223?: Check whether you run Apache OFBiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in Apache OFBiz due to improper control of code generation within the DataResource editing component. Specifically, the application fails to sufficiently sanitize user-provided input used in FreeMarker templates. An authenticated attacker with 'Content/DataResource' editing privileges can inject malicious FreeMarker directives to execute arbitrary Java code on the server. This vulnerability is exploited over the network and results in full Remote Code Execution (RCE) under the context of the OFBiz service. The issue is resolved in version 24.09.07.

Affected products

Apache OFBiz before 24.09.07

Timeline

2026-06-10: disclosed
2026-06-10: advisory
2026-06-10: patched: Fixed in version 24.09.07

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.