CVE-2021-26295: Apache OFBiz

Critical severity, CVSS 9.8. EPSS: 97.8% chance of exploitation in the next 30 days.

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Affected products

• Apache OFBiz: before 17.12.06 (fixed in 17.12.06)

Published 2021-03-22. Last modified 2026-06-17.