Apache OFBiz is a free, open-source ERP and CRM system written in Java and maintained by the Apache Software Foundation under the Apache License 2.0. The current release is OFBiz 24.09.07, published in June 2026. Before you deploy it, know its security record: CISA lists three OFBiz flaws as exploited in the wild, and the project fixed 19 more in 2026.
Checked 1 October 2026 against the OFBiz download and security pages, the ofbiz-framework repository and its README, and the US government’s Known Exploited Vulnerabilities catalog. If you still run the 18.12 line, note that every OFBiz security fix published in 2026 shipped only in 24.09.06 or 24.09.07.
What is Apache OFBiz ERP?
OFBiz (Open For Business) is a suite of business applications, including accounting, order management, catalog and e-commerce, warehousing, manufacturing, human resources and CRM, built on a Java framework that developers can extend. It is an open-source ERP rather than a packaged product with a vendor: you download it, host it and customize it yourself or with a service partner. The project describes itself like this:
An Apache top level project since 2006, OFBiz has shown its stability and maturity as an enterprise-wide ERP solution that is flexible enough to change with your business.
Apache OFBiz, ofbiz.apache.org
Apache OFBiz at a glance
| Fact | Detail |
|---|---|
| Current release | 24.09.07 (June 2026); the 24.09 line started with 24.09.01 in April 2025 |
| Previous line | 18.12, last release 18.12.19 (March 2025); it received none of the 2026 security fixes |
| License | Apache License 2.0 |
| Language and build | Java (JDK 17 required), built and run with the included Gradle wrapper |
| Source code | apache/ofbiz-framework on GitHub, still committed to daily. The older apache/ofbiz repository is archived. |
| Price | Free; you pay for hosting, development and support |
| Governance | Apache top-level project since 2006 |
Architecture
OFBiz is a Java web application with three core layers, in the project’s own words an entity engine, a service engine and a widget-based UI. The entity engine maps business data to a relational database, the service engine runs business logic as reusable services, and the widget layer builds screens and forms from XML definitions, with FreeMarker templates and Groovy scripts where code is needed. The ERP applications are built on these layers, so customizing OFBiz usually means adding or overriding services, entities and screens rather than editing a closed product.
Optional features ship as plugins in a separate repository. They include project management (projectmgr) and Scrum, e-commerce and a CMS site, business intelligence and BIRT reporting, Solr and Lucene search, LDAP and third-party login (passport), and asset maintenance.
Is Apache OFBiz secure?
OFBiz is secure enough to run only if you keep it on the latest release, because its own record shows a steady flow of serious vulnerabilities. Three are on the US Cybersecurity and Infrastructure Security Agency’s (CISA) catalog of flaws known to be exploited in the wild, each with a deadline by which US federal agencies had to patch it:
| CVE | Type (CISA) | Added to CISA catalog | Fixed in |
|---|---|---|---|
| CVE-2024-32113 | Path traversal | 7 Aug 2024 | 18.12.13 |
| CVE-2024-38856 | Incorrect authorization | 27 Aug 2024 | 18.12.15 |
| CVE-2024-45195 | Forced browsing | 4 Feb 2025 | 18.12.16 |
The project’s security page lists 74 CVEs in all. The count has risen sharply: 9 carry 2024 CVE numbers, 5 carry 2025 numbers and 19 carry 2026 numbers so far, and every one of the 2026 fixes shipped in 24.09.06 (May 2026) or 24.09.07 (June 2026). In practice that means:
- Run the latest 24.09 release and subscribe to the project’s security announcements.
- Treat 18.12 as unpatched. Its last release, 18.12.19, predates all 19 of the 2026 fixes. An earlier version of this page pointed readers to 18.12.13, which is affected by two of the three exploited flaws above.
- Change the demo administrator password (admin / ofbiz in the README) or load only seed data before the server is reachable.
- Follow the project’s Technical Production Setup Guide rather than exposing a development install.
Pricing
OFBiz costs nothing to license: the Apache License 2.0 lets you download, use, modify and resell it. What you pay for is everything around it. A realistic budget covers a server or cloud instance, Java developers to configure the applications and build what your business needs on the framework, data migration, and ongoing work to apply security releases, which in 2026 meant at least two upgrades. The project publishes no price list because there is nothing to sell; we do not quote implementation costs we cannot verify.
Modules
The back-office applications appear in the OFBiz Applications menu: AP, AR, Accounting, Catalog, Content, Facility, HR, Manufacturing, Marketing, Order, Party, SFA (sales force automation) and Work Effort, plus Business Intelligence and Web Tools for administrators. What each covers:
Accounting (GL, AR, AP, FA)
General ledger, accounts receivable and payable, invoicing, payments and fixed assets, with separate AP and AR applications for day-to-day payables and collections work.
Customer relationship management (CRM)
The Party application holds customers, suppliers and contacts with their roles and relationships, and SFA adds leads, opportunities and sales activities.
Order management and E-commerce
Sales and purchase orders, returns and order reports in the Order Manager, with the ecommerce plugin providing an online storefront connected to the same catalog and orders.
Warehousing and Inventory Management
The Facility application manages warehouses and other facilities, the inventory held in them, and incoming and outgoing shipments.
Manufacturing and MRP
Bills of materials, routings, production runs and material requirements planning, with Work Effort tracking the tasks and resources involved.
Project management
Earlier versions of this page said OFBiz has no project management. It does: the projectmgr plugin adds a Project application and the scrum plugin a Scrum application, both installed from the plugins repository.
How to download Apache OFBiz?
Download a release from the official downloads page (24.09.07 at the time of writing) or clone the source from GitHub. The steps below follow the project’s README:
- Install the full Java Development Kit (JDK) 17 and set
JAVA_HOME. - Get the code: unpack the release, or run
git clone https://github.com/apache/ofbiz-framework.git. - Prepare the database with demo data:
./gradlew cleanAll loadAll(on Windows,gradlew cleanAll loadAll). - Start OFBiz:
./gradlew ofbiz, and wait for it to finish starting. - Open
https://localhost:8443/webtoolsfor administration, or/ordermgrand/accountingfor the back office, and log in as admin with the password ofbiz.
OFBiz builds with the Gradle wrapper that ships in the repository, so there is no separate Maven or Gradle install. Instructions that tell you to run Maven or to clone github.com/apache/ofbiz are out of date: that repository is archived (last pushed in April 2020) and says main development has moved to ofbiz-framework. For servers, the README points to Docker documentation and to the Technical Production Setup Guide.
Advantages
- Free under the Apache License 2.0, with no per-user fees and the right to modify and redistribute.
- Broad scope: accounting, orders, catalog, warehouse, manufacturing, HR and CRM in one data model.
- Governed by the Apache Software Foundation and still actively developed: the main repository had new commits on 1 October 2026.
- Built to be extended: the entity and service engines let developers add business logic without forking the core.
- Security issues are published openly, with the affected and fixed versions for each CVE.
Disadvantages
- A heavy security maintenance load: 19 CVEs fixed in 2026 so far, and three past flaws exploited in the wild.
- Needs Java developers. OFBiz is a framework as much as a product, and most companies customize it.
- No vendor: support comes from the community mailing lists or from third-party service providers.
- Upgrading between release lines, such as 18.12 to 24.09, is a project in its own right, and the old line no longer gets security fixes.
- The back-office interface is functional rather than modern, as the screenshots above show.
Alternatives
If you want to stay on Java, the closest maintained alternatives are iDempiere, metasfresh and Axelor. If the language does not matter, Odoo Community and ERPNext have the largest communities. Each had code committed on GitHub in the two weeks to 30 September 2026:
| Open-source ERP | Language | License | GitHub stars |
|---|---|---|---|
| Odoo Community | Python | LGPLv3 | 54,757 |
| ERPNext | Python | GPLv3 | 39,679 |
| Dolibarr | PHP | GPLv3 | 7,673 |
| metasfresh | Java | GPLv2 | 2,435 |
| Apache OFBiz | Java | Apache 2.0 | 1,125 |
| Axelor Open Suite | Java | AGPLv3 | 979 |
| iDempiere | Java | GPLv2 | 664 |
| Tryton | Python | GPLv3 | 226 |
For a wider comparison, see our list of ERP software.
Who uses Apache OFBiz?
The OFBiz project does not publish a customer list, and we could not verify the company names that earlier versions of this page carried, several of which are OFBiz service providers rather than users. We have removed them rather than repeat claims we cannot check. If you are evaluating OFBiz, ask any service partner you consider for references you can contact.
Apache OFBiz vs Odoo
| Apache OFBiz | Odoo | |
|---|---|---|
| What it is | ERP framework and applications from the Apache Software Foundation | ERP suite from Odoo S.A.; compared here as its open-source Community edition |
| Languages | Java, Groovy, FreeMarker, XML | Python, JavaScript, XML |
| License | Apache License 2.0 | Community: LGPLv3 |
| Deployment | Self-hosted | Self-hosted, or hosted by Odoo |
| Community size (GitHub stars, 30 Sep 2026) | 1,125 | 54,757 |
| Who it suits | Companies with Java developers who want to own and extend the whole system | Companies that want ready-made apps and a large partner network |
FAQs
How does Apache OFBiz work?
OFBiz is a Java web application built on its own framework: an entity engine that maps business data to the database, a service engine that runs business logic, and a widget-based user interface. The ERP applications (accounting, orders, catalog, warehouse, manufacturing, HR) are built on that framework, and optional plugins add features such as project management and e-commerce. You run it on your own server with Java 17 and open it in a browser.
Is Apache OFBiz free?
Yes. OFBiz is released under the Apache License 2.0, so the software is free to download, use, modify and sell on. The costs are in running it: a server, Java developers to configure and extend it, and keeping up with security releases.
What is the latest version of Apache OFBiz?
OFBiz 24.09.07, released in June 2026, on the 24.09 line that began with 24.09.01 in April 2025. The older 18.12 line last released 18.12.19 in March 2025, and none of the 19 security fixes with 2026 CVE numbers shipped for it.
Is Apache OFBiz secure?
Only if you keep it up to date. The US Cybersecurity and Infrastructure Security Agency lists three OFBiz vulnerabilities as exploited in the wild (CVE-2024-32113, CVE-2024-38856 and CVE-2024-45195), and the project’s security page lists 74 CVEs in total, 19 of them with 2026 numbers. Run the latest 24.09 release and change the demo admin password before the server is reachable.
What Java version does Apache OFBiz need?
The current OFBiz README requires the full Java Development Kit (JDK) version 17, not just the runtime. OFBiz builds with the Gradle wrapper included in the repository, so you do not need to install Gradle or Maven separately.
What is the default Apache OFBiz login?
After loading the demo data, the README says you can log in to the administrator interface at https://localhost:8443/webtools with the user admin and the password ofbiz. Change it, or load only seed data, before putting a server on any network you do not control.
How we checked this page
On 1 October 2026 we read the OFBiz download and security pages, the README and tags of the apache/ofbiz-framework repository and the plugin list of apache/ofbiz-plugins through the GitHub API, and the CISA Known Exploited Vulnerabilities catalog (version 2026.09.30) filtered for OFBiz. We counted CVEs by year from the security page and matched each exploited CVE to its fixed release there. Release dates are the dates of the release tags. The alternatives’ data comes from each project’s GitHub repository and license file, checked on 30 September 2026. We did not run OFBiz ourselves for this update.
Conclusion
Apache OFBiz is a capable, free and genuinely open ERP framework, and it suits companies that have Java developers and want to own their system end to end. It is not a set-and-forget product: in 2026 alone the project shipped two security releases fixing 19 CVEs, and three earlier flaws were exploited in the wild. If you choose it, start on 24.09.07, change the demo password, and budget for upgrades. If you do not have Java skills in house, a hosted alternative such as Odoo or ERPNext will cost you less effort.
References
- Apache OFBiz home page, downloads and security vulnerabilities page
- apache/ofbiz-framework on GitHub and its README
- apache/ofbiz-plugins on GitHub
- CISA Known Exploited Vulnerabilities catalog
- Apache OFBiz Technical Production Setup Guide
- Apache OFBiz technical documentation
Using Google Search? Add erp-information.com as a preferred source.