Critical RCE Vulnerabilities Found in Bonita BPM and Apache OFBiz Enterprise Java Servers
Pre-authentication remote code execution vulnerabilities, including CVE-2026-31986, have been discovered in widely used enterprise Java applications Bonita BPM and Apache OFBiz, posing a significant risk to organizations.
Vulnerability researchers have uncovered critical pre-authentication remote code execution (RCE) flaws in two prominent enterprise Java platforms: Bonita BPM and Apache OFBiz. The vulnerabilities, detailed by researchers at Novee and presented at Black Hat USA 2026, allow unauthenticated attackers to execute arbitrary code on affected servers by sending a single, specially crafted web request.
The Bonita BPM vulnerability, identified as CVE-2026-31986, targets internal APIs that are not adequately protected. Attackers can bypass multiple security checks, including session and CSRF token requirements, by manipulating URL path segments. Once inside the internal API surface, which trusts its callers, the attacker can leverage the XStream library to deserialize malicious XML payloads. These payloads can exploit gadget chains from Commons Collections to execute arbitrary commands on the host system, effectively granting the attacker full control.
Apache OFBiz faces a similar threat, with a separate but related vulnerability also allowing RCE. This exploit leverages the platform's single sign-on (SSO) mechanism. The default signing key for OFBiz SSO tokens is often publicly accessible in the source repository, allowing attackers to forge valid admin tokens. Furthermore, by manipulating callback tokens for the widget engine and exploiting an accessibility preference that enables Groovy script evaluation, attackers can inject and execute arbitrary commands. A denylist designed to prevent script injection is bypassed by capitalizing the first letter of a command or by using auto-imported classes.
These vulnerabilities are particularly concerning given the sensitive nature of the organizations that utilize these platforms. Bonita BPM is commonly used for critical business processes such as loan approvals, insurance claims processing, and employee onboarding in the finance, insurance, and government sectors. Apache OFBiz is also widely deployed in enterprise environments. The ability for an attacker to gain unauthenticated RCE on these systems presents a severe risk of data breaches, system compromise, and operational disruption.
Novee reported these findings responsibly to both Bonita and Apache, who responded swiftly to remediate the issues. Apache OFBiz released new versions addressing the vulnerabilities, and Bonita also issued updates following the disclosure. Researchers noted that while these two platforms had the most critical impact, their audit of four enterprise Java platforms uncovered a total of 12 vulnerabilities, including sandbox escapes and other pre-login flaws, with two other platforms yet to release updates.
The researchers highlighted that these vulnerabilities are difficult to detect with signature-based scanners because they are built from seemingly innocuous components and rely on the specific chaining of insecure configurations and code paths. The exploit lies in the interconnectedness of these weak points, rather than a single glaring flaw.
Organizations using Bonita BPM or Apache OFBiz are strongly advised to update to the latest patched versions immediately. The critical nature of these RCE vulnerabilities, coupled with their pre-authentication exploitability, makes them a prime target for widespread exploitation. Security teams should also review their internal API security and ensure that all internal services are hardened as if they were exposed to the public internet.
The discovery underscores the ongoing challenges in securing complex enterprise Java applications. The reliance on third-party libraries, intricate configuration settings, and the potential for subtle misconfigurations to create critical attack vectors remain persistent threats in the cybersecurity landscape.