PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41919 Apache Software Foundation CVE debrief

Apache OFBiz versions prior to 24.09.06 contain a critical LDAP injection vulnerability (CWE-90) that allows unauthenticated remote attackers to manipulate LDAP queries. The vulnerability stems from improper neutralization of special elements in LDAP queries, potentially enabling authentication bypass, privilege escalation, or unauthorized data access in environments using LDAP for directory services. The CVSS 3.1 score of 9.1 reflects network attack vector, low complexity, no privileges required, and high impact to confidentiality and integrity. Apache released version 24.09.06 on May 19, 2026 to address this issue. No known exploitation in ransomware campaigns has been reported.

Vendor
Apache Software Foundation
Product
Apache OFBiz
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-19
Advisory published
2026-05-19
Advisory updated
2026-05-19

Who should care

Organizations running Apache OFBiz with LDAP integration for authentication or directory services; security teams managing ERP systems; identity and access management administrators responsible for directory service security

Technical summary

The vulnerability exists in Apache OFBiz's LDAP integration components where user-supplied input is incorporated into LDAP queries without adequate sanitization. Attackers can inject LDAP filter syntax to alter query logic, potentially bypassing authentication checks or extracting directory information. The attack requires no authentication and is exploitable over the network. OFBiz deployments using LDAP for user authentication or directory synchronization are at highest risk. The fix in 24.09.06 implements proper input validation and parameterized LDAP queries.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Apache OFBiz to version 24.09.06 or later immediately
  • If immediate patching is not feasible, restrict network access to OFBiz administrative interfaces and LDAP-dependent authentication endpoints
  • Review LDAP query construction in custom OFBiz extensions for proper input validation
  • Monitor authentication logs for anomalous LDAP query patterns or unexpected directory traversal attempts
  • Validate that upstream LDAP servers implement query filtering and rate limiting as defense-in-depth

Evidence notes

CWE-90 (LDAP Injection) confirmed via Apache security advisory. Affected versions confirmed through CPE criteria: all Apache OFBiz versions before 24.09.06. CVSS vector confirms network-accessible, unauthenticated attack with high confidentiality and integrity impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41919 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41919

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41919 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41919

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.