CyberSecBulletin
CVE-2026-90908NVD status: Awaiting Analysis

Payara Server: Reliance on Untrusted Inputs in a Security Decision

Published Updated By the CyberSecBulletin desk

CVE-2026-90908 is a critical-severity reliance on untrusted inputs in a security decision vulnerability in Payara Server from Azul Payara, with a CVSS 4.0 base score of 9.3 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 7.6.0, 7.2026.11, 6.44.0 as the first without the flaw, so updating Payara Server to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.54% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Payara Server to 7.6.0 or 7.2026.11 or 6.44.0 or 5.93.0, whichever matches your release line, or a later version.
  2. Update Payara Micro to 7.6.0 or 7.2026.11 or 6.44.0 or 5.93.0, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Azul PayaraPayara Server7.0.0 up to, but not including, 7.6.0; 7.2024.1.Alpha1 up to, but not including, 7.2026.11; 6.0.0 up to, but not including, 6.44.0; 6.2022.1 through 6.2025.11; 5.20.0 up to, but not including, 5.93.0; 5.181 through 5.201.2; 5.2020.2 through 5.2022.5; 4.1.2.191 up to, but not including, 4.1.2.191.617.6.0, 7.2026.11, 6.44.0, 5.93.0, 4.1.2.191.61
Azul PayaraPayara Micro7.0.0 up to, but not including, 7.6.0; 7.2024.1.Alpha1 up to, but not including, 7.2026.11; 6.0.0 up to, but not including, 6.44.0; 6.2022.1 through 6.2025.11; 5.20.0 up to, but not including, 5.93.0; 5.181 through 5.201.2; 5.2020.2 through 5.2022.5; 4.1.1.154.1 up to, but not including, 4.1.2.191.617.6.0, 7.2026.11, 6.44.0, 5.93.0, 4.1.2.191.61

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Attack requirements
NoneThe attack does not depend on a particular deployment or configuration.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Confidentiality (vulnerable system)
HighSerious loss of confidentiality on the vulnerable system.
Integrity (vulnerable system)
HighSerious loss of integrity on the vulnerable system.
Availability (vulnerable system)
HighSerious loss of availability on the vulnerable system.
Confidentiality (other systems)
NoneNo loss of confidentiality on systems beyond the vulnerable one.
Integrity (other systems)
NoneNo loss of integrity on systems beyond the vulnerable one.
Availability (other systems)
NoneNo loss of availability on systems beyond the vulnerable one.

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA.

Official description

A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the MBean server and lead to remote code execution. Azul Payara Micro is affected only when its JMX connector is enabled.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Reliance on Untrusted Inputs in a Security Decision

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

How developers prevent this class of flaw

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State and the OWASP ESAPI Session Management feature. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.
  • For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
  • When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.

More Reliance on Untrusted Inputs in a Security Decision vulnerabilities (CWE-807)

Timeline

  1. CVE record published.

References

Other vulnerabilities in Payara Server

All Payara Server vulnerabilities

Recent Reliance on Untrusted Inputs in a Security Decision vulnerabilities

Spotted an error? Tell us.