{"id":"CVE-2021-26295","published":"2021-03-22T12:00:18Z","modified":"2025-02-13T16:27:51Z","title":"RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI","vendor":"Apache Software Foundation","product":"Apache OFBiz","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache OFBiz","versions":["Apache OFBiz 17.12.01 to 17.12.05"]}],"description":{"text":"Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an unsafe deserialization issue in Apache OFBiz, affecting versions prior to 17.12.06, arising from Java serialisation handled through RMI.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:06Z"},"cvss":null,"epss":{"score":0.97822,"percentile":0.99906,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-12-05","exploitedFirstSeen":"2023-12-05","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2021-26295","date":"2023-12-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-06&host_type=src&vulnerability=cve-2021-26295","date":"2023-12-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-19&host_type=src&vulnerability=cve-2021-26295","date":"2023-12-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-24&host_type=src&vulnerability=cve-2021-26295","date":"2023-12-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-14&host_type=src&vulnerability=cve-2021-26295","date":"2024-01-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-15&host_type=src&vulnerability=cve-2021-26295","date":"2024-01-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-17&host_type=src&vulnerability=cve-2021-26295","date":"2024-01-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-26295","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2021-26295","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2021-26295","date":"2024-01-24"}],"evidenceTotal":753,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'","url":"https://otx.alienvault.com/pulse/6668b85065eec626e4766a38","created":"2024-06-11"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r3c1802eaf34aa78a61b4e8e044c214bc94accbd28a11f3a276586a31%40%3Cuser.ofbiz.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r6e4579c4ebf7efeb462962e359501c6ca4045687f12212551df2d607%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0%40%3Cdev.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6%40%3Cdev.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a%40%3Cdev.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc9bd0d3d794dc370bc70585960841868cb29b92dcc80552b84ca2599%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/rbe512e5ccd6b11169c6379daa1234bc805f3d53c5a38224e956295ce%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-13106","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-13106","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2021-03-23","earliestUrl":"https://github.com/yumusb/CVE-2021-26295","repos":[{"name":"yumusb/CVE-2021-26295","url":"https://github.com/yumusb/CVE-2021-26295","stars":23,"created":"2021-03-23"},{"name":"yuaneuro/ofbiz-poc","url":"https://github.com/yuaneuro/ofbiz-poc","stars":5,"created":"2021-05-13"},{"name":"rakjong/CVE-2021-26295-Apache-OFBiz","url":"https://github.com/rakjong/CVE-2021-26295-Apache-OFBiz","stars":4,"created":"2021-03-24"},{"name":"dskho/CVE-2021-26295","url":"https://github.com/dskho/CVE-2021-26295","stars":0,"created":"2021-03-25"},{"name":"coolyin001/CVE-2021-26295--","url":"https://github.com/coolyin001/CVE-2021-26295--","stars":0,"created":"2021-04-09"}]},"metasploit":[{"name":"Apache OFBiz SOAP Java Deserialization","module":"exploit/linux/http/apache_ofbiz_deserialization_soap","type":"exploit","disclosureDate":"2021-03-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization_soap.rb"}],"nuclei":[{"id":"CVE-2021-26295","name":"Apache OFBiz <17.12.06 - Arbitrary Code Execution","severity":"critical","path":"http/cves/2021/CVE-2021-26295.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26295.yaml"}],"first":{"date":"2021-03-22","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization_soap.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html"],"flow":[],"timeline":[{"date":"2021-03-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-26295","provenance":"source"},{"date":"2021-03-22","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-03-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization_soap.rb","provenance":"source"},{"date":"2023-12-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2021-26295","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":60.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1061 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}