{"id":"CVE-2026-97355","kind":"vulnerability","aliases":["CVE-2026-97355"],"related":[],"title":"Apache OFBiz: hard-coded control key lets anyone shut down the server","description":"Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09.07 ships a fixed default control key in start.properties that protects its AdminServer control port. An attacker who can reach that port can read the server's running state and shut the instance down without logging in.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","runtime","self-hosted"],"not_affected_if":["default-config-changed","other-version","port-not-reachable"],"how_to_check":"- Check the OFBiz version in use; `24.09.07` is affected.\n- Look in `start.properties` for the default AdminServer control key shipped with the distribution.\n- Check whether the AdminServer control port is reachable from networks outside the host.","fix":"- Apache OFBiz: upgrade to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:07+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","triaged_at":"2026-11-05T14:40:30+00:00","updated_at":"2026-11-05T14:40:30+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T14:40:30Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`.","reach":"network","title":"Apache OFBiz: hard-coded control key lets anyone shut down the server","impact":"medium","summary":"Apache OFBiz 24.09.07 ships a fixed default control key in start.properties that protects its AdminServer control port. An attacker who can reach that port can read the server's running state and shut the instance down without logging in.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker shuts down the OFBiz instance without credentials","analyst_note":"","how_to_check":"- Check the OFBiz version in use; `24.09.07` is affected.\n- Look in `start.properties` for the default AdminServer control key shipped with the distribution.\n- Check whether the AdminServer control port is reachable from networks outside the host.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config-changed","port-not-reachable","other-version"],"who_is_affected":"Teams running Apache OFBiz 24.09.07 with the default start.properties, where the AdminServer control port can be reached over the network. Instances that restrict that port to localhost or change the default control key are less exposed. The sources do not say whether other OFBiz versions are affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":4261,"output_tokens":526,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-97355':16A,19A '24.09.07':30B,80C '24.09.08':125C 'abl':87C 'adminserv':42B,75C,91C 'allow':84C 'anyon':9A 'apach':1A,21B,28B,78C 'apache-ofbiz':20B 'attack':46B,86C 'code':5A,70C 'compon':76C 'control':6A,35B,43B,92C,113C 'cve':14A,17A 'default':34B,112C 'fix':33B,111C,127C 'hard':4A,69C 'hard-cod':3A,68C 'host':27B 'instanc':62B,108C 'issu':129C 'java':23B 'key':7A,36B,114C 'let':8A 'log':65B 'ofbiz':2A,22B,29B,79C 'password':71C 'platform':83C 'port':44B,51B,93C 'protect':40B 'queri':95C 'reach':49B,89C 'read':53B 'recommend':120C 'run':57B,99C 'runtim':24B 'self':26B 'self-host':25B 'server':13A,55B,97C 'ship':31B,115C 'shut':10A,60B 'shutdown':105C 'start.properties':38B,117C 'state':58B,100C 'trigger':102C 'unauthent':104C 'upgrad':122C 'use':66C 'user':118C 'version':124C 'via':109C 'vulner':72C 'without':64B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09.07 with the default start.properties, where the AdminServer control port can be reached over the network. Instances that restrict that port to localhost or change the default control key are less exposed. The sources do not say whether other OFBiz versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","java","medium","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97355","severity":null,"published_at":"2026-11-05T14:17:07+00:00","modified_at":"2026-11-05T14:17:07+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","fetched_at":"2026-11-05T14:39:19+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}