# CVE-2021-26295: Apache OFBiz - RCE

> Live exploitation tracking for CVE-2021-26295 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-26295

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Apache OFBiz
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)
- **Tags:** java

## Description

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

## CrowdSec analysis

[CVE-2021-26295](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-26295) is a critical remote code execution vulnerability in Apache OFBiz, where unsafe deserialization allows attackers to compromise targeted systems without authentication.

CrowdSec has been tracking this vulnerability and its exploits since 19th of June 2024.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2021-26295 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2021-26295 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Exploitation attempts typically involve requests to URLs containing `/webtools/control/soapservice`.

## Timeline

- 2021-03-22: CVE Published. CVE-2021-26295 is published to NVD.
- 2024-06-19: Rule Released. CrowdSec releases a rule to detect CVE-2021-26295 exploitation attempts against the CrowdSec Network.
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-26295 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26295.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-26295) follows observed exploitation activity for CVE-2021-26295. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.