Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts
Priority LOW 28CWE-307Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-307.
Summary
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed Payara Server (Payara): 7.2.0, 7.2026.7, 6.40.0 +2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Payara Platform | Payara Server | 7.0.0 to before 7.2.0; 7.2025.1 to before 7.2026.7; 6.0.0 to before 6.40.0; 5.20.0 to before 5.89.0; 4.1.144 to before 4.1.2.191.57; 6.2023.1 and later; 5.2020.1 and later | 7.2.0, 7.2026.7, 6.40.0, 5.89.0, 4.1.2.191.57 | Patch available | CNA |
- Payara Server VendorPayara Platform Affected 7.0.0 to before 7.2.0; 7.2025.1 to before 7.2026.7; 6.0.0 to before 6.40.0; 5.20.0 to before 5.89.0; 4.1.144 to before 4.1.2.191.57; 6.2023.1 and later; 5.2020.1 and later Fixed in 7.2.0, 7.2026.7, 6.40.0, 5.89.0, 4.1.2.191.57 Patch available CNA
Remediation
- Fix · CNA Payara Server (Payara) Fixed in 7.2.0, 7.2026.7, 6.40.0, 5.89.0, 4.1.2.191.57
Timeline
- 2026-10-02 Threatist record created from CVE-2026-92082
- 2026-10-03 Alias added: GHSA-mwf3-qj4r-2qq4
References
Other 5
- https://docs.azul.com/payara/release-notes/release-notes-7.2.0.html
- https://docs.azul.com/payara/version/6/release-notes/release-notes-6.40.0.html
- https://docs.azul.com/payara/version/5/release-notes/release-notes-5.89.0.html
- https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.57.html
- https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html
More Payara Platform vulnerabilities
- TI-2022-22205 Payara before 2022-11-04, when deployed to the root context, allows attackers to visit… CVSS 3.1HIGH 7.5
- TI-2021-18200 Payara Micro Community 5.2021.6 and below allows Directory Traversal. CVSS 3.1HIGH 7.5
- TI-2023-13003 A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191… CVSS 3.1CRITICAL 9.8
- TI-2024-07614 Payload Injection Attack via Management REST interface CVSS 4.0HIGH 8.7
- TI-2025-13101 Admin Account Takeover via malicious URL payload CVSS 4.0HIGH 7.3
- TI-2022-17489 Payara through 5.2022.2 allows directory traversal without authentication. CVSS 3.1HIGH 7.5
Sources
- CVE-2026-92082 · CVE Program
- CVE-2026-92082 · NVD
- FIRST EPSS
- GHSA-mwf3-qj4r-2qq4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences