Vulnerability researchers have uncovered critical pre-authentication remote code execution (RCE) flaws in two widely used enterprise Java platforms, Bonita BPM and Apache OFBiz. These vulnerabilities, which allow an attacker to execute arbitrary code on a server without prior authentication, were detailed at Black Hat USA 2026 by researchers from Novee. The findings are part of a broader audit that identified 12 vulnerabilities across four enterprise Java platforms, including a sandbox escape and four pre-authentication flaws.
The Bonita BPM vulnerability, affecting version 10.4.3, stems from a series of misconfigurations in its API routing and security filters. Bonita BPM is used by banks, insurers, and government agencies for processes like loan approvals and employee onboarding. The platform maintains both a public and an internal API surface. The public surface requires a session and a Cross-Site Request Forgery (CSRF) token, while the internal surface uses basic authentication and processes XML input via the XStream library.
The researchers found that a single web request could bypass three independent security checks designed to protect the internal API. One check misinterprets a path segment containing `..;` as an ordinary name, while Tomcat's dispatcher strips the semicolon and treats it as a directory traversal, routing the request to the internal surface. Another check uses a substring match for authentication and CSRF filters, allowing a fabricated application name in the path to satisfy both. Finally, a protection intended for direct requests fails to apply to forwarded ones, allowing an internally forwarded request to pass through untouched. Chaining these weaknesses enables an unauthenticated attacker to reach the internal API.
Once inside the internal API, the attacker leverages the XStream library, which deserializes XML into Java objects. By crafting malicious XML, an attacker can reconstruct a gadget chain using Commons Collections classes, bypassing typical safety checks and leading to a Groovy call that executes arbitrary commands. This RCE occurs within a single XStream call before the request completes.
The Apache OFBiz vulnerability, affecting version 24.09.05, involves a default signing key and a script evaluation flaw. OFBiz's single sign-on (SSO) tokens are signed with a key that is publicly available in the source repository. Any OFBiz installation retaining this default key is vulnerable. An attacker can forge an SSO token, sign it with the default key, and claim administrator privileges.
With administrative rights, the attacker can then exploit a vulnerability in OFBiz's widget engine. The widget engine's callback tokens contain a field specifying a screen area to render. OFBiz reads this field and feeds it into a template expander that evaluates Groovy code. An accessibility preference, which an administrator can toggle, controls whether this evaluation runs. The forged admin account can enable this preference, then send a token containing a Groovy command in place of the screen name. While a denylist attempts to block script injection, it is bypassed by using a capitalized "ProcessBuilder" or an auto-imported class that requires no prefix. This chain of vulnerabilities, identified as CVE-2026-31986, allows for critical code execution from two unauthenticated GET requests on any OFBiz installation with SSO enabled.
The researchers emphasize that both exploit chains are composed of individually innocuous-looking components, such as a stray URL segment, a misconfigured filter, a missing configuration line, a default key, or a regex without a case flag. This makes them difficult for signature scanners to detect, as the exploit lies in how these pieces connect.
Novee reported all findings to the affected projects, and both Bonita and OFBiz have released new versions to address these specific vulnerabilities. OFBiz, in particular, responded quickly and kept the researchers updated throughout the remediation process. Both vendors completed their fixes within the standard 90-day disclosure timeline. While two other enterprise Java platforms were also audited and found to have vulnerabilities, their names remain undisclosed, though the researchers noted that Bonita and OFBiz had the most critical impact.
Organizations using enterprise Java platforms are advised to harden internal routing, treating it as if it were exposed to the internet. It is also recommended to remove unsafe execution primitives and ensure that rendering toggles do not gate calls to evaluation functions.
