← All articles Threat Intelligence

New Apache OFBiz zero-day exploited in the wild.

📅 April 26, 2026 · CybernytronX Team
New Apache OFBiz zero-day exploited in the wild.

Introduction: A Critical Zero-Day Under Active Exploitation

The cybersecurity community is on high alert following the discovery of a critical zero-day vulnerability in Apache OFBiz, an open-source enterprise resource planning (ERP) system widely used for e-commerce, accounting, and supply chain management. Tracked as CVE-2024-36104, this flaw allows unauthenticated remote attackers to execute arbitrary code on vulnerable servers, and evidence confirms it is being actively exploited in the wild. Threat actors, including ransomware affiliates and advanced persistent threat (APT) groups, have already weaponized the vulnerability, targeting organizations across manufacturing, retail, and financial sectors. This article dissects the technical underpinnings of the exploit, its real-world impact, and actionable mitigations—while underscoring how CybernytronX, powered by Ethereon AI threat detection, can help organizations stay ahead of such emerging threats.

Threat Context: Why Apache OFBiz Is a Prime Target

Apache OFBiz is a mature, feature-rich framework that handles sensitive business operations, including order management, inventory, and accounting. Its extensive adoption—particularly among small to medium enterprises (SMEs) and Fortune 500 companies alike—makes it a lucrative target. The zero-day, rated CVSS 9.8 (Critical), resides in the org.apache.ofbiz.securityext module, specifically within the SecurityPermission class. The flaw enables path traversal and deserialization attacks, allowing attackers to bypass authentication entirely. Security researchers at ShadowServer and GreyNoise have observed exploitation attempts originating from IP addresses linked to known botnets, including those associated with the Mirai variant and the Androxgh0st malware family. This suggests that the vulnerability is being leveraged for both initial access and lateral movement within compromised networks.

Technical Details: Unpacking CVE-2024-36104

The vulnerability exploits a flaw in Apache OFBiz's handling of serialized Java objects. Specifically, the SecurityPermission class fails to properly validate user-supplied data during the deserialization process. An attacker can craft a malicious HTTP request containing a serialized object that, when deserialized, triggers arbitrary code execution. The exploit path is as follows:

A simplified proof-of-concept (PoC) request is shown below:

POST /webtools/control/checkLogin HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

USERNAME=base64_encoded_serialized_object&PASSWORD=anything

Notably, the exploit does not require any prior authentication, meaning any exposed OFBiz instance is vulnerable. The flaw affects all versions prior to Apache OFBiz 18.12.13, which was released on April 25, 2024, as an emergency patch. However, due to delayed patching cycles, many production environments remain exposed.

Impact: Real-World Exploitation and Consequences

Active exploitation of CVE-2024-36104 has been confirmed by multiple threat intelligence platforms. As of late May 2024, Shodan scans reveal over 15,000 internet-facing OFBiz instances, with a significant percentage running unpatched versions. The most concerning aspect is the integration of this exploit into automated scanning tools and ransomware operations. For example, the LockBit ransomware group has been observed using the vulnerability to deploy Cobalt Strike beacons, leading to data exfiltration and encryption. In one documented incident, attackers exploited the flaw to gain initial access to a retail organization's ERP system, then pivoted to Active Directory to deploy ransomware across 2,000 endpoints. The financial impact is severe: the average cost of a ransomware attack on an ERP system is estimated at $4.5 million, factoring in downtime, data recovery, and regulatory fines under GDPR or CCPA.

"This is not a theoretical risk. We are seeing mass scanning and exploitation within hours of the PoC being published. Organizations that have not patched are effectively inviting attackers into their core business systems." — ShadowServer Incident Response Team

Mitigations: Immediate and Long-Term Actions

To defend against active exploitation, organizations must take the following steps:

For legacy systems that cannot be patched immediately, consider deploying a virtual patch through an intrusion prevention system (IPS) or using runtime application self-protection (RASP) tools to intercept deserialization attacks.

How CybernytronX Can Help

At CybernytronX, we understand that zero-day vulnerabilities like CVE-2024-36104 can bypass traditional signature-based defenses. Our Ethereon AI threat detection platform uses behavioral analysis and machine learning to identify anomalous deserialization patterns in real time, even before a patch is available. Ethereon AI correlates exploit attempts with known adversary infrastructure, providing security teams with actionable alerts and automated response workflows. For Apache OFBiz specifically, our platform offers pre-built detection rules that flag base64-encoded payloads in HTTP requests and monitor for post-exploitation activities such as Cobalt Strike beaconing. By integrating CybernytronX into your security stack, you can reduce mean time to detection (MTTD) from hours to minutes and proactively defend against both known and unknown threats. Contact our team today to schedule a demo of Ethereon AI and see how we can help safeguard your enterprise ERP systems from the next wave of zero-day attacks.

← Back to all articles