PAYARA SERVER · CVE-2026-90908 · Runtime
FIX → 7.2026.11 · 6.44.0 · 5.93.0 · 4.1.2.191.61 +1 ✓ verified
Payara Server and Payara Micro, Java application servers from Azul, have an authentication bypass in the GenericAdminAuthenticator component. A remote attacker can spoof the client host address to get past JMX/RMI admin restrictions, then reach the MBean server and run code.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Payara Server or Payara Micro install on the listed older versions that exposes JMX/RMI administration to a network an attacker can reach. A remote unauthenticated attacker can spoof the client host address to get admin access to the MBean server and run code. Payara Micro can skip this if the JMX connector is not enabled; so can any install whose JMX/RMI port is not reachable from untrusted networks.
Not affected if admin-port-not-exposed, jmx-connector-disabled, jmx-port-not-reachable
Who cares java, jmx, payara, payara-micro, self-hosted
7.6.0, 6.44.0, 5.93.0 or 4.1.2.191.61, or Community 7.2026.11 and earlier ( through also listed). 2) Payara Micro is affected only when its JMX connector is enabled; check your start options and config for JMX. 3) Check whether the JMX/RMI admin port is reachable from untrusted networks; if it is, treat it as exposed until patchedA vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the MBean server and lead to remote code execution. Azul Payara Micro is affected only when its JMX connector is enabled.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
6.2022.16.2025.11Upgrade to 7.2026.11 · 6.44.0 · 5.93.0 · 4.1.2.191.61 +1
7.6.0, 6.44.0, 5.93.0 or 4.1.2.191.61 (Server and Micro), or Payara Community 7.2026.11s release notes list the fix as FISH-14190 Remote Code Execution in JMX'This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.