Payara vulnerabilities
We track 4 vulnerabilities in Payara products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 24, 2026.
Latest Payara vulnerabilities
- 7.3 High severity
Payara Server: Cross-Site Request Forgery
A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeov
- 8.4 High severity
Payara Server: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Server: from 5.20.0 before 5.68.0, from 6.
- 9.8 Critical severity
Payara Server: Deserialization of Untrusted Data
A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server
- 7.5 High severity
Payara: Files or Directories Accessible to External Parties
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1