CVE-2026-68536: org.apache.myfaces.core/myfaces-impl: Apache MyFaces: Server-Side Request Forgery and Local File Inclusion Vulnerability

Severity: Critical

CVSS Score: 9.8

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected.  Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.