CVE-2026-68536

Summary

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.

Older unsupported versions may also be affected. 

Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache MyFaces2.2.0-beta <= 2.2.15affected
Apache Software FoundationApache MyFaces2.3.0affected
Apache Software FoundationApache MyFaces2.3-next-M1 < 2.3-next-M9affected
Apache Software FoundationApache MyFaces2.3.1 < 2.3.12affected
Apache Software FoundationApache MyFaces3.0.0 < 3.0.4affected
Apache Software FoundationApache MyFaces4.0.0 < 4.0.4affected
Apache Software FoundationApache MyFaces4.1.0 < 4.1.4affected

Weaknesses

  • CWE-918: CWE-918 Server-Side Request Forgery (SSRF)

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References