CVE-2026-68536Critical· 9.8▾ Midnight

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 53.9 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 16, 2026

Updated

Sep 17, 2026

CVSS

9.8

Vendor

Apache Software Foundation

Product

org.apache.myfaces.core:myfaces-impl

CWE

CWE-918

Depth score

54 · Moderate

EPSS

0.49% · p42

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scores by source

NVD 9.8 · Vendor 5.3⚖ 4.5-point dispute

CISA SSVC

decided 2026-09-17

Exploitation: none
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 19.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 9 days

Sep 16, 2026Published
Disclosed via NVD
Sep 17, 2026Record revised
Last analysed / modified upstream
Sep 17, 2026CVSS changed
— → 9.8
Sep 17, 2026Severity changed
none → critical
Sep 19, 2026EPSS first tracked
0.5%
Sep 25, 2026EPSS peak
0.5% → 0.5%

Apache Software Foundation CWE-918 #nvd #cve.org #csaf #vex #red-hat #score-dispute

Affected

org.apache.myfaces.core:myfaces-impl >= 2.2.0-beta <= 2.2.15
org.apache.myfaces.core:myfaces-impl 2.3.0
org.apache.myfaces.core:myfaces-impl >= 2.3-next-M1 < 2.3-next-M9
org.apache.myfaces.core:myfaces-impl >= 2.3.1 < 2.3.12
org.apache.myfaces.core:myfaces-impl >= 3.0.0 < 3.0.4
org.apache.myfaces.core:myfaces-impl >= 4.0.0 < 4.0.4
org.apache.myfaces.core:myfaces-impl >= 4.1.0 < 4.1.4

Full technical detail▾

Overview

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.

Older unsupported versions may also be affected.

Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Vendor advisories

Red Hat VEX · Moderate · affected: Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat OpenStack Platform 13 (Queens) · updated 2026-09-23 · vex

References

Change history

Field changes observed since this record was first indexed.

Sep 17, 2026CVSS — → 9.8
Sep 17, 2026Severity none → critical

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#csaf#vex#red-hat#score-dispute

← Back to feed

CVE-2026-68536Critical· 9.8▾ Midnight

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 53.9 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 16, 2026

Updated

Sep 17, 2026

CVSS

9.8

Vendor

Apache Software Foundation

Product

org.apache.myfaces.core:myfaces-impl

CWE

CWE-918

Depth score

54 · Moderate

EPSS

0.49% · p42

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scores by source

NVD 9.8 · Vendor 5.3⚖ 4.5-point dispute

CISA SSVC

decided 2026-09-17

Exploitation: none
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 19.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 9 days

Sep 16, 2026Published
Disclosed via NVD
Sep 17, 2026Record revised
Last analysed / modified upstream
Sep 17, 2026CVSS changed
— → 9.8
Sep 17, 2026Severity changed
none → critical
Sep 19, 2026EPSS first tracked
0.5%
Sep 25, 2026EPSS peak
0.5% → 0.5%

Apache Software Foundation CWE-918 #nvd #cve.org #csaf #vex #red-hat #score-dispute

Affected

org.apache.myfaces.core:myfaces-impl >= 2.2.0-beta <= 2.2.15
org.apache.myfaces.core:myfaces-impl 2.3.0
org.apache.myfaces.core:myfaces-impl >= 2.3-next-M1 < 2.3-next-M9
org.apache.myfaces.core:myfaces-impl >= 2.3.1 < 2.3.12
org.apache.myfaces.core:myfaces-impl >= 3.0.0 < 3.0.4
org.apache.myfaces.core:myfaces-impl >= 4.0.0 < 4.0.4
org.apache.myfaces.core:myfaces-impl >= 4.1.0 < 4.1.4

Full technical detail▾

Overview

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.

Older unsupported versions may also be affected.

Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Vendor advisories

Red Hat VEX · Moderate · affected: Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat OpenStack Platform 13 (Queens) · updated 2026-09-23 · vex

References

Change history

Field changes observed since this record was first indexed.

Sep 17, 2026CVSS — → 9.8
Sep 17, 2026Severity none → critical

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#csaf#vex#red-hat#score-dispute