CVE-2021-30128

Confirmed PUBLISHED

Unsafe deserialization in Apache OFBiz

Apache Software Foundation · Apache OFBiz

Not yet in CISA KEV

Exploited in the wild Active exploitation observed PoC available Virtual patch available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Get the Pro API

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

Unique Attacker IPs

CISA KEV

Not yet in CISA KEV

Virtual Patch

Yes 3 targets

CVSS / EPSS

9.8 Critical EPSS 81.1%

At a Glance

Apache OFBiz has unsafe deserialization prior to 17.12.07 version

apache nuclei_scanner

CVE Published: Apr 27, 2021
Exploitation Reported: Jun 12, 2026
CVSS: 9.8 Critical
EPSS: 81.1%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Apache Software Foundation	Apache OFBiz	Apache OFBiz to < 17.12.07	Affected

CVE References

[ofbiz-notifications] 20210427 [jira] [Updated] (OFBIZ-12221) Fixed ObjectInputStream denyList [CVE-2021-30128] lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb82f41de3c44bb644632531f7964904...
[ofbiz-notifications] 20210427 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128] lists.apache.org · Mailing List https://lists.apache.org/thread.html/rbe512e5ccd6b11169c6379daa1234bc...
[oss-security] 20210427 [CVE-2021-30128] Unsafe deserialization in OFBiz openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/04/27/5
[ofbiz-user] 20210427 [CVE-2021-30128] Unsafe deserialization in OFBiz lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e29199...
[ofbiz-commits] 20210427 [ofbiz-site] branch master updated: Updates security page for CVE-2021-29200 and 30128 fixed in 17.12.07 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c18...

Show 5 more references

[announce] 20210427 [CVE-2021-30128] Unsafe deserialization in OFBiz lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e29199...
[ofbiz-notifications] 20210605 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128] lists.apache.org · Mailing List https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae81684...
[ofbiz-notifications] 20210729 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128] lists.apache.org · Mailing List https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428...
[ofbiz-commits] 20210811 [ofbiz-site] branch master updated: Updates security page for CVE-2021-37608 fixed in 17.12.08 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4...
Apache Mailing List lists.apache.org · CVE Record https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e29199...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
KEVIntel First	2026-06-12 00:32 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 1
Distinct User-Agents: 18

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30128.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2026-06-12 00:32:50 UTC · KEVIntel

Active exploitation observed

Recorded 2026-06-12 00:32:50 UTC · KEVIntel sensor

Proof of concept available

Recorded 2021-04-29 17:59:59 UTC · GitHub

Weaknesses (CWE)

CWE-502

Deserialization of Untrusted Data

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30128.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

LioTree/CVE-2021-30128-EXP

github · Created 2021-04-29 17:59:59 UTC · 20 stars

Apache OFBiz <17.12.07 - Arbitrary Code Execution

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Get the Pro API View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-30128

{
  "cve_id": "CVE-2021-30128",
  "title": "Unsafe deserialization in Apache OFBiz",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache OFBiz",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.81079,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-30128

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 29 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

Supported Platforms

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API