CVE-2026-92082: Payara Server Auth Bypass Vulnerability

CVE-2026-92082 Overview

CVE-2026-92082 affects Payara Server, a Jakarta EE and MicroProfile-compatible application server. By default, Payara Server does not limit the number of failed login attempts, exposing the administrative and application authentication surfaces to brute force attacks. The weakness is classified as Improper Restriction of Excessive Authentication Attempts [CWE-307]. Payara provides a built-in automatic attack protection feature that administrators must enable to remediate the exposure. The vulnerability requires adjacent network access and no privileges, and it primarily impacts subsequent system confidentiality once an attacker guesses valid credentials.

Critical Impact
Attackers on an adjacent network can perform unlimited credential-guessing attempts against Payara Server, enabling account takeover of administrative or application accounts when weak passwords are in use.

Affected Products

Payara Server versions prior to 4.1.2.191.57
Payara Server versions prior to 5.89.0 and 6.40.0
Payara Server versions prior to 7.2.0 and Payara Community 7.2026.7

Discovery Timeline

2026-09-15 - CVE-2026-92082 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-92082

Vulnerability Analysis

Payara Server ships with authentication realms that accept repeated login attempts without any built-in throttling, lockout, or backoff. An attacker with reachability to the administrative console, REST management interface, or application authentication endpoints can submit an unbounded number of username and password combinations. Successful guessing yields access to the account tier being targeted, which in the administrative case allows management of deployed applications and server configuration.

The scope classification indicates that a successful attack impacts systems beyond the vulnerable component itself, because a compromised Payara administrator can pivot into deployed applications, connected data stores, and downstream services the server integrates with.

Root Cause

The root cause is a missing security control rather than a code defect. Payara Server did not enable automatic attack protection by default, leaving the authentication logic without any rate limiting or account lockout policy. This maps to [CWE-307]: Improper Restriction of Excessive Authentication Attempts.

Attack Vector

Exploitation requires network reachability to a Payara authentication endpoint on an adjacent network segment. No prior credentials or user interaction are required. An attacker uses standard credential-stuffing or dictionary-based tooling against the login form, the asadmin remote interface, or any application-level authentication path exposed by deployed applications relying on the container's authentication realms. Because failed attempts are not throttled, the attack scales linearly with attacker bandwidth. Refer to the Payara Security Guide for configuration details on the built-in protection.

Detection Methods for CVE-2026-92082

Indicators of Compromise

High volumes of failed authentication events in the Payara server.log for a single account or from a single source address within a short time window.
Successful administrative login from an unexpected source address immediately following a burst of failed attempts.
Creation of new administrative users, unexpected application deployments, or configuration changes in domain.xml shortly after suspicious authentication activity.

Detection Strategies

Correlate authentication failure events across the Payara admin listener, HTTP listener, and any custom realms to identify distributed brute force patterns.
Baseline normal administrative login sources and alert on new geolocations, ASNs, or user agents authenticating to the admin console.
Alert on anomalous session creation rates and on asadmin command invocations from non-management network zones.

Monitoring Recommendations

Forward Payara server.log and access logs to a centralized log platform with retention sufficient to reconstruct multi-day guessing campaigns.
Track failed-to-successful login ratios per source address and per account, and generate alerts when thresholds are exceeded.
Monitor changes to authentication realm configuration and to the automatic attack protection settings, since attackers may attempt to disable them after compromise.

How to Mitigate CVE-2026-92082

Immediate Actions Required

Upgrade Payara Server to a fixed release: 4.1.2.191.57, 5.89.0, 6.40.0, 7.2.0, or Payara Community 7.2026.7 as appropriate for your major version.
Enable the built-in automatic attack protection feature as described in the Payara Security Guide, and configure lockout thresholds and durations aligned with your password policy.
Restrict network exposure of the administrative interface to management networks only, and require VPN or bastion access for administrators.
Rotate credentials for administrative and application accounts and enforce strong password requirements.

Patch Information

Azul has addressed the missing control across the supported Payara branches. Refer to the vendor release notes for the fix in your branch: Payara Community 7.2026.7, Payara 7.2.0, Payara 6.40.0, Payara 5.89.0, and Payara 4.1.2.191.57.

Workarounds

Place Payara administrative endpoints behind a reverse proxy or web application firewall that enforces rate limiting and IP-based lockouts on authentication paths.
Use network access control lists to restrict access to the admin listener (default port 4848) to a small set of management hosts.
Deploy multi-factor authentication in front of application authentication flows where the container realm cannot be replaced.

bash

# Configuration example - enable Payara automatic attack protection
# Refer to the Payara Security Guide for the authoritative syntax
asadmin> set configs.config.server-config.security-service.property.max-login-attempts=5
asadmin> set configs.config.server-config.security-service.property.login-attempt-window-seconds=300
asadmin> set configs.config.server-config.security-service.property.lockout-duration-seconds=900