Exploited: CISA Highlights Apache OFBiz Flaw After PoC Emerges

Apache OFBiz has a critical pre-authentication RCE (CVE-2024-38856, CVSS 9.8) that affects all versions up to 18.12.14; SonicWall researchers discovered the flaw while testing fixes for a related vulnerability and published an exploit chain and PoC details. CISA added the issue to its Known Exploited Vulnerabilities catalog, public PoCs and observed exploitation attempts increase real-world risk, and organizations (including federal agencies) are urged to upgrade to 18.12.15 immediately to mitigate the threat.