--- title: "CVE-2026-68536: Apache MyFaces Core - Server-Side Request Forgery & Local File Inclusion" description: "Apache MyFaces Core contains a server-side request forgery and local file inclusion caused by improper input validation, letting attackers make arbitrary server requests or include local files, exploit requires crafted requests." url: https://panop.io/threat-heartbeat/CVE-2026-68536/ --- # CVE-2026-68536 Apache MyFaces Core - Server-Side Request Forgery & Local File Inclusion Apache MyFaces Core contains a server-side request forgery and local file inclusion caused by improper input validation, letting attackers make arbitrary server requests or include local files, exploit requires crafted requests. CVSS base score 9.8 /10 Critical CISA KEV Not listed Public exploit None known Authentication Not required EPSS 0.49% chance of exploitation in 30 days [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-68536) ## Details Type Server-Side Request Forgery Impact Server Side Request Forgery, File System Read CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Published 16 September 2026 Updated 15 October 2026 Weakness [CWE-918](https://cwe.mitre.org/data/definitions/918.html) ## Vendor fix Upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-68536](https://nvd.nist.gov/vuln/detail/CVE-2026-68536) - [https://lists.apache.org/thread/4kwh2dys1sdcm3o4pbk41t2lt9or72qq](https://lists.apache.org/thread/4kwh2dys1sdcm3o4pbk41t2lt9or72qq) - [http://www.openwall.com/lists/oss-security/2026/09/16/13](http://www.openwall.com/lists/oss-security/2026/09/16/13) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)