Payara Server vulnerabilities

2 known vulnerabilities in Payara Server from Azul Payara. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  Payara Server: Reliance on Untrusted Inputs in a Security Decision

  CVE-2026-90908Nov 12, 2026Azul Payara

  A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation c

• 9.3 Critical severity

  Payara Server: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-110003Nov 12, 2026Azul Payara

  A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waiv