CVE-2026-68536— Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability
Quick assessment
Affected
Apache Software Foundation Apache MyFaces
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
Affected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache MyFaces | 2.2.0-beta≤ 2.2.15 |
affected |
2.3.0 |
affected | ||
2.3-next-M1< 2.3-next-M9 |
affected | ||
2.3.1< 2.3.12 |
affected | ||
3.0.0< 3.0.4 |
affected | ||
4.0.0< 4.0.4 |
affected | ||
4.1.0< 4.1.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-68536
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.
Older unsupported versions may also be affected.
Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache MyFaces | 2.2.0-beta ~ 2.2.15 | - |
|
II. Public POCs for CVE-2026-68536
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-68536
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-68536 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-16 · 20 CVEs total
| CVE-2026-87976 | 7.2 HIGH | Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles |
| CVE-2026-82561 | 5.9 MEDIUM | Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods |
| CVE-2026-86089 | 2.3 LOW | Apache NiFi: Missing Process Group Authorization for Connector Migration |
| CVE-2026-81866 | 0.5 LOW | Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configur |
| CVE-2026-86465 | Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via us | |
| CVE-2026-70469 | Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests | |
| CVE-2026-82311 | Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _us | |
| CVE-2026-86462 | Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed | |
| CVE-2026-86792 | Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Sched | |
| CVE-2026-82310 | Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API | |
| CVE-2026-76186 | Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session iden | |
| CVE-2026-76187 | Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session J | |
| CVE-2026-86466 | Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validate | |
| CVE-2026-59739 | Apache ZooKeeper: Information disclosure via SetWatches reconnect replay | |
| CVE-2026-59969 | Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode | |
| CVE-2026-79993 | Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion | |
| CVE-2026-84439 | Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources | |
| CVE-2026-84501 | Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationP | |
| CVE-2026-76646 | Apache MyFaces: Denial of Service via Unbounded Request Parsing |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Conte -
CVE-2026-81866
Apache NiFi: Missing Authorization for Assets and Secrets Re -
CVE-2026-82561
Apache NiFi: Missing Authorization for Components Referenced -
CVE-2026-86089
Apache NiFi: Missing Process Group Authorization for Connect -
CVE-2026-87976
Apache NiFi Registry: Improper Limitation of Pathname in Per
Same weakness: CWE-918
-
CVE-2026-92527
chatwoot Shopify OAuth callbacks_controller.rb server-side r -
CVE-2026-92808
Server-Side Request Forgery in Altium Enterprise Server Unif -
CVE-2026-87116
Tanium addressed a server-side request forgery vulnerability -
CVE-2026-59823
LiteLLM: Server-side request forgery via the `user_config` r -
CVE-2026-92719
Quickwit through 0.9.0 SSRF via SQS queue_url Parameter
V. Comments for CVE-2026-68536
No comments yet