Cyber Resilience

CVE-2026-29207

Medium

Published: 19 May 2026

Published
19 May 2026
Modified
19 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0019 41.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-29207 is a medium-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Apache Ofbiz. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version,…

more

"Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.

CWE(s)
CWE-1336

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Server-side template injection (CWE-1336) in public-facing Apache OFBiz web app directly enables exploitation of the application for initial access and RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

apache
ofbiz
≤ 24.09.06

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References