CVE-2026-90908

Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator

Assigner: Payara
Reserved: 14.09.2026 Published: 12.11.2026 Updated: 12.11.2026

A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the MBean server and lead to remote code execution. Azul Payara Micro is affected only when its JMX connector is enabled.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Azul Payara
Product	Payara Server
Versions	Default: unaffected affected from 7.0.0 to 7.6.0 (excl.) affected from 7.2024.1.Alpha1 to 7.2026.11 (excl.) affected from 6.0.0 to 6.44.0 (excl.) affected from 6.2022.1 to 6.2025.11 (incl.) affected from 5.20.0 to 5.93.0 (excl.) affected from 5.181 to 5.201.2 (incl.) affected from 5.2020.2 to 5.2022.5 (incl.) affected from 4.1.2.191 to 4.1.2.191.61 (excl.)

Vendor

Azul Payara

Product

Payara Server

Versions

Default: unaffected

affected from 7.0.0 to 7.6.0 (excl.)
affected from 7.2024.1.Alpha1 to 7.2026.11 (excl.)
affected from 6.0.0 to 6.44.0 (excl.)
affected from 6.2022.1 to 6.2025.11 (incl.)
affected from 5.20.0 to 5.93.0 (excl.)
affected from 5.181 to 5.201.2 (incl.)
affected from 5.2020.2 to 5.2022.5 (incl.)
affected from 4.1.2.191 to 4.1.2.191.61 (excl.)

Vendor	Azul Payara
Product	Payara Micro
Versions	Default: unaffected affected from 7.0.0 to 7.6.0 (excl.) affected from 7.2024.1.Alpha1 to 7.2026.11 (excl.) affected from 6.0.0 to 6.44.0 (excl.) affected from 6.2022.1 to 6.2025.11 (incl.) affected from 5.20.0 to 5.93.0 (excl.) affected from 5.181 to 5.201.2 (incl.) affected from 5.2020.2 to 5.2022.5 (incl.) affected from 4.1.1.154.1 to 4.1.2.191.61 (excl.)