CVE-2025-54466 is a critical (CVSS 9.8) code injection flaw in the Apache OFBiz scrum plugin that can lead to remote code execution. It affects OFBiz before 24.09.02 and only when the scrum plugin is used. Upgrade to 24.09.02. The sections below cover who is affected, how to check, and what to do first.
What's affected
- Apache OFBiz before 24.09.02 is affected, but only when the scrum plugin is used.
- Fixed in 24.09.02, which the advisory recommends.
- The record says even unauthenticated attackers can exploit it.
The record lists CVSS 9.8 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check whether the scrum plugin is present in your OFBiz plugins directory and loaded in your component configuration.
ls plugins | grep -i scrum
Then check your OFBiz release version in the release notes or build files against 24.09.02.
What to do now
- Upgrade to Apache OFBiz 24.09.02 or later.
- If you do not use the scrum plugin, remove it from the build.
- Restrict the OFBiz web ports to trusted networks until you have updated.
- Review server logs for unexpected requests to scrum plugin endpoints.
- Read the OFBiz security page for related advisories.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-94, improper control of code generation. Input reaches a place where it is treated as code. The record gives no further mechanism and this post will not guess one.
OFBiz has had a run of serious advisories, and plugins widen the surface. Removing plugins you do not use is a cheap, effective control. The record does not flag KEV status.
Severity scores are a starting point. The score for this entry is 9.8, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
I do not use the scrum plugin. Am I affected?
The record says the issue applies only when the plugin is used. Still upgrade to stay current.
Is there a fixed version?
Yes, 24.09.02.
Sources
- https://issues.apache.org/jira/browse/OFBIZ-13276
- https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915
- https://ofbiz.apache.org/download.html
- https://ofbiz.apache.org/release-notes-24.09.02.html
- https://ofbiz.apache.org/security.html
- http://www.openwall.com/lists/oss-security/2025/08/05/1
Last reviewed: 18 October 2026.
