Skip to main content

Payara EUVDEUVD-2026-78575

| CVE-2026-92082 MEDIUM
Improper Restriction of Excessive Authentication Attempts (CWE-307)
2026-09-15 Payara GHSA-mwf3-qj4r-2qq4
Information Disclosure Payara Payara Server
6.3
CVSS 4.0 · Vendor: Payara
Share

Severity by source

Vendor (Payara) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Amber

Primary rating from Vendor (Payara) · only source for this CVE.

CVSS VectorVendor: Payara

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Sep 15, 2026 - 15:17 EUVD
Analysis Generated
Sep 15, 2026 - 15:05 vuln.today

DescriptionCVE.org

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see  https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

AnalysisAI

Payara Server ships by default without any cap on failed authentication attempts, so its administrative console and application login endpoints can be hammered with unlimited password guesses. The issue is a classic missing-lockout / missing-rate-limit weakness (CWE-307) affecting Payara Server Enterprise 4.x, 5.x, 6.x and 7.x plus the Payara Server Community 7 line, with fixes published in releases 4.1.2.191.57, 5.89.0, 6.40.0, 7.2.0 and Community 7.2026.7. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Payara

View all
CVE-2022-45129 HIGH POC
7.5 Nov 10

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different
CVE-2021-41381 HIGH POC
7.5 Sep 23

Payara Micro Community 5.2021.6 and below allows Directory Traversal. Rated high severity (CVSS 7.5), this vulnerability
CVE-2023-28462 CRITICAL
9.8 Mar 30

A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterpris
CVE-2024-8215 HIGH
8.7 Oct 08

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Plat
CVE-2022-37422 HIGH
7.5 Aug 18

Payara through 5.2022.2 allows directory traversal without authentication. Rated high severity (CVSS 7.5), this vulnerab
CVE-2026-12986 HIGH
7.3 Jun 24

Full unauthenticated administrative takeover of Payara Server Full (4.x through 7.2026.x, including 6.2024.x and 6.2025.
CVE-2024-7312 HIGH
7.0 Sep 11

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Inte
CVE-2025-1534 MEDIUM
6.8 Apr 01

CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Pla
CVE-2023-41699 MEDIUM
6.1 Nov 15

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (

Same weakness CWE-307 – Improper Restriction of Excessive Authentication Attempts

View all
CVE-2022-33106 CRITICAL POC
9.8
CVE-2026-44596 CRITICAL POC
9.8
CVE-2024-43042 CRITICAL POC
9.8
CVE-2024-39225 CRITICAL POC
9.8
CVE-2024-24767 CRITICAL POC
9.8
CVE-2023-6272 CRITICAL POC
9.8
CVE-2023-6756 CRITICAL POC
9.8
CVE-2023-49443 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-78575 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy