{"id":"CVE-2026-68536","aliases":["EUVD-2026-80990","GHSA-5fv6-hxpr-6p55"],"status":"published","title":"Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability","description":"Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported versions may also be affected. \n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00487,"percentile":0.42405,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-09-16T18:40:17Z","modified":"2026-09-17T21:32:41Z","products":[{"vendor":"apache software foundation","product":"apache myfaces"}],"references":[{"url":"https://lists.apache.org/thread/4kwh2dys1sdcm3o4pbk41t2lt9or72qq","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/16/13"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68536"},{"url":"https://github.com/advisories/GHSA-5fv6-hxpr-6p55"}],"sources":{"cve":[{"id":"CVE-2026-68536","title":"Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability","description":"Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported versions may also be affected. \n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.","status":"published","published":"2026-09-16T18:40:17.043Z","modified":"2026-09-17T20:08:09.598Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:45:59.110885Z"}],"euvd":[{"id":"EUVD-2026-80990","description":"Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported versions may also be affected. \n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.","status":"published","published":"2026-09-16T18:40:17Z","modified":"2026-09-17T20:08:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:09.684322Z"}],"ghsa":[{"id":"GHSA-5fv6-hxpr-6p55","title":"Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported...","description":"Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported versions may also be affected. \n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.","status":"published","published":"2026-09-16T21:32:43Z","modified":"2026-09-17T21:32:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:12:08.779152Z"}],"nvd":[{"id":"CVE-2026-68536","description":"Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported versions may also be affected. \n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.","status":"published","published":"2026-09-16T19:17:25.143Z","modified":"2026-09-17T21:17:19.29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:48.630594Z"}]}}