CVE-2026-68536: Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability
Published Sep 16, 2026
·Updated
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.
Older unsupported versions may also be affected.
Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
Affected Software
1 affected component
Apache MyFaces Core<2.3.12, =2.3-next-M9, <3.0.4, <4.0.4, <4.1.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache MyFaces (MyFaces Core)to a version that resolves this vulnerability.Fixed in 2.3.12 - Upgrade
Upgrade
Apache MyFaces (MyFaces Core)to a version that resolves this vulnerability.Fixed in 2.3-next-M9 - Upgrade
Upgrade
Apache MyFaces (MyFaces Core)to a version that resolves this vulnerability.Fixed in 3.0.4 - Upgrade
Upgrade
Apache MyFaces (MyFaces Core)to a version that resolves this vulnerability.Fixed in 4.0.4 - Upgrade
Upgrade
Apache MyFaces (MyFaces Core)to a version that resolves this vulnerability.Fixed in 4.1.4
Event History
Sep 16, 2026
CVE Published
via MITRE·06:40 PM
Data Sourced
via MITRE·06:40 PM
DescriptionWeakness