Payara Server vulnerabilities

2 known vulnerabilities in Payara Server from Payara. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  Payara Server: Cross-Site Request Forgery

  CVE-2026-12986Jun 24, 2026Payara

  A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeov

• 9.8 Critical severity

  Payara Server: Deserialization of Untrusted Data

  CVE-2023-28462Mar 30, 2023Payara

  A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server