---
id: "CVE-2026-97355"
kind: "vulnerability"
aliases: ["CVE-2026-97355"]
title: "Apache OFBiz: hard-coded control key lets anyone shut down the server"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-ofbiz", "java", "runtime", "self-hosted"]
not_affected_if: ["default-config-changed", "other-version", "port-not-reachable"]
published_at: "2026-11-05T14:17:07+00:00"
first_seen_at: "2026-11-05T14:39:19+00:00"
updated_at: "2026-11-05T14:40:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97355", "first_seen_at": "2026-11-05T14:39:19+00:00"}]
exploit_sources: []
---

# Apache OFBiz: hard-coded control key lets anyone shut down the server

Apache OFBiz 24.09.07 ships a fixed default control key in start.properties that protects its AdminServer control port. An attacker who can reach that port can read the server's running state and shut the instance down without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OFBiz version in use; `24.09.07` is affected.
- Look in `start.properties` for the default AdminServer control key shipped with the distribution.
- Check whether the AdminServer control port is reachable from networks outside the host.

## Fix

- Apache OFBiz: upgrade to `24.09.08`.

## Timeline

- 2026-11-05T14:39:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97355

## From the sources

Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_