by Kastro CVE-2026-90908
Azul Payara Payara Server — Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator
Description · from the CVE record
A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the MBean server and lead to remote code execution. Azul Payara Micro is affected only when its JMX connector is enabled.
Affected
ProductAffectedFixed inSource
Payara Server7.0.0 – < 7.6.07.6.0CNA
Payara Server7.2024.1.Alpha1 – < 7.2026.117.2026.11CNA
Payara Server6.0.0 – < 6.44.06.44.0CNA
Payara Server6.2022.1 – 6.2025.11–CNA
Payara Server5.20.0 – < 5.93.05.93.0CNA
Payara Server5.181 – 5.201.2–CNA
Payara Server5.2020.2 – 5.2022.5–CNA
Payara Server4.1.2.191 – < 4.1.2.191.614.1.2.191.61CNA
Payara Micro7.0.0 – < 7.6.07.6.0CNA
Payara Micro7.2024.1.Alpha1 – < 7.2026.117.2026.11CNA
Payara Micro6.0.0 – < 6.44.06.44.0CNA
Payara Micro6.2022.1 – 6.2025.11–CNA
Scores by source
Payara (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N