CVE-2026-68536

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68536", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-30T19:41:56.980Z", "datePublished": "2026-09-16T18:40:17.043Z", "dateUpdated": "2026-09-17T20:08:09.598Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-16T18:40:17.043Z"}, "title": "Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability", "problemTypes": [{"descriptions": [{"description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "cweId": "CWE-918", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache MyFaces", "packageURL": "pkg:maven/org.apache.myfaces.core/myfaces-impl", "versions": [{"status": "affected", "version": "2.2.0-beta", "lessThanOrEqual": "2.2.15", "versionType": "maven"}, {"status": "affected", "version": "2.3.0", "versionType": "maven"}, {"status": "affected", "version": "2.3-next-M1", "lessThan": "2.3-next-M9", "versionType": "maven"}, {"status": "affected", "version": "2.3.1", "lessThan": "2.3.12", "versionType": "maven"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.4", "versionType": "maven"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.4", "versionType": "maven"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.4", "versionType": "maven"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.myfaces.core:myfaces-impl"}], "descriptions": [{"value": "Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported versions may also be affected.\u00a0\n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.<br><br>Older unsupported versions may also be affected.&nbsp;<br><br>Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.<br><br>"}]}], "references": [{"url": "https://lists.apache.org/thread/4kwh2dys1sdcm3o4pbk41t2lt9or72qq", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/16/13"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-16T19:09:40.984Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T20:07:19.754515Z", "id": "CVE-2026-68536", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T20:08:09.598Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-68536", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-17T20:07:19.754515Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-17T20:07:07.843Z"}}], "cna": {"title": "Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache MyFaces", "versions": [{"status": "affected", "version": "2.2.0-beta", "versionType": "maven", "lessThanOrEqual": "2.2.15"}, {"status": "affected", "version": "2.3.0", "versionType": "maven"}, {"status": "affected", "version": "2.3-next-M1", "lessThan": "2.3-next-M9", "versionType": "maven"}, {"status": "affected", "version": "2.3.1", "lessThan": "2.3.12", "versionType": "maven"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.4", "versionType": "maven"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.4", "versionType": "maven"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.4", "versionType": "maven"}], "packageURL": "pkg:maven/org.apache.myfaces.core/myfaces-impl", "packageName": "org.apache.myfaces.core:myfaces-impl", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/4kwh2dys1sdcm3o4pbk41t2lt9or72qq", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported versions may also be affected.\u00a0\n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.", "supportingMedia": [{"type": "text/html", "value": "Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.<br><br>Older unsupported versions may also be affected.&nbsp;<br><br>Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-16T18:40:17.043Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68536", "state": "PUBLISHED", "dateUpdated": "2026-09-16T19:09:40.984Z", "dateReserved": "2026-07-30T19:41:56.980Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-16T18:40:17.043Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.myfaces.core:myfaces-impl", "packageURL": "pkg:maven/org.apache.myfaces.core/myfaces-impl", "product": "Apache MyFaces", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.2.15", "status": "affected", "version": "2.2.0-beta", "versionType": "maven"}, {"status": "affected", "version": "2.3.0", "versionType": "maven"}, {"lessThan": "2.3-next-M9", "status": "affected", "version": "2.3-next-M1", "versionType": "maven"}, {"lessThan": "2.3.12", "status": "affected", "version": "2.3.1", "versionType": "maven"}, {"lessThan": "3.0.4", "status": "affected", "version": "3.0.0", "versionType": "maven"}, {"lessThan": "4.0.4", "status": "affected", "version": "4.0.0", "versionType": "maven"}, {"lessThan": "4.1.4", "status": "affected", "version": "4.1.0", "versionType": "maven"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\n\nOlder unsupported versions may also be affected.\u00a0\n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue."}], "id": "CVE-2026-68536", "lastModified": "2026-09-17T21:17:19.290", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68536", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-17T20:07:19.754515Z", "version": "2.0.3"}}]}, "published": "2026-09-16T19:17:25.143", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/4kwh2dys1sdcm3o4pbk41t2lt9or72qq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/16/13"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.myfaces.core/myfaces-impl: Apache MyFaces: Server-Side Request Forgery and Local File Inclusion Vulnerability", "id": "2535597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535597"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.\nOlder unsupported versions may also be affected.\u00a0\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.", "A flaw was found in Apache MyFaces Core. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF), which can trick the server into making requests to arbitrary domains, potentially accessing internal resources. Additionally, Local File Inclusion (LFI) is possible, enabling an attacker to include local files on the server, which could lead to information disclosure or arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-68536", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2026-09-16T18:40:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68536\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68536\nhttps://lists.apache.org/thread/4kwh2dys1sdcm3o4pbk41t2lt9or72qq"], "statement": "This flaw has a Moderate impact in Apache MyFaces Core. A remote attacker can send specially crafted requests to an affected application to cause server-side requests to unintended local or remote resources, with possible local file inclusion and information disclosure. The known Red Hat product affect is OpenStack 13's out-of-support OpenDaylight component.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0-beta,2.2.15]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.3-next-M1,2.3-next-M9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.3.1,2.3.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.4)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache MyFaces", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "myfaces", "vendor": "apache"}], "created": "2026-09-18T01:45:16.781980+00:00", "updated": "2026-09-18T06:00:04.704709+00:00", "vendors": ["apache", "apache$PRODUCT$myfaces"]}