CVE-2026-68536: Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability
Apache MyFaces discloses moderate SSRF and local file inclusion vulnerability CVE-2026-68536 affecting all maintained 2.2 through 4.1 branches.
Apache MyFaces (org.apache.myfaces.core:myfaces-impl) disclosed CVE-2026-68536, a server-side request forgery and local file inclusion vulnerability rated moderate. Affected versions include the 2.2.*, 2.3.*, 3.0.*, 4.0.*, 4.1.* and 2.3-next-* branches. No exploitation details or patch status were provided in the disclosure.
- Server-side request forgery and local file inclusion flaw in the MyFaces JSF implementation.
- All maintained branches affected: 2.2, 2.3, 3.0, 4.0, 4.1 and 2.3-next.
- Severity rated moderate by the Apache MyFaces team; no exploitation reported.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68536 | SSRF and Local File Inclusion in Apache MyFaces Core | 9.8 | — |
From the original article
Posted by Volodymyr Siedlecki on Sep 16 Severity: moderate Affected versions: - Apache MyFaces (org. apache. myfaces.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.