{"id":"CVE-2026-90908","kind":"vulnerability","aliases":["CVE-2026-90908"],"related":[],"title":"Payara Server and Micro: spoofed client host address bypasses JMX/RMI admin restrictions, leading to remote code execution","description":"A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the MBean server and lead to remote code execution. Azul Payara Micro is affected only when its JMX connector is enabled.","summary":"Payara Server and Payara Micro, Java application servers from Azul, have an authentication bypass in the GenericAdminAuthenticator component. A remote attacker can spoof the client host address to get past JMX/RMI admin restrictions, then reach the MBean server and run code.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Payara Server","fixed":["7.6.0","6.44.0","5.93.0","4.1.2.191.61","7.2026.11"],"affected":"< 7.6.0","ecosystem":"vendor"},{"name":"Payara Micro","fixed":["7.6.0","6.44.0","5.93.0","4.1.2.191.61","7.2026.11"],"affected":"< 7.6.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","jmx","payara","payara-micro","runtime","self-hosted"],"not_affected_if":["admin-port-not-exposed","jmx-connector-disabled","jmx-port-not-reachable"],"how_to_check":"1) Find your version: asadmin version (Server) or java -jar payara-micro.jar --version. Vulnerable if older than 7.6.0, 6.44.0, 5.93.0 or 4.1.2.191.61, or Community 7.2026.11 and earlier (6.2022.1 through 6.2025.11 also listed). 2) Payara Micro is affected only when its JMX connector is enabled; check your start options and config for JMX. 3) Check whether the JMX/RMI admin port is reachable from untrusted networks; if it is, treat it as exposed until patched. Restrict that port with a firewall meanwhile.","fix":"Upgrade to Azul Payara 7.6.0, 6.44.0, 5.93.0 or 4.1.2.191.61 (Server and Micro), or Payara Community 7.2026.11. Azul's release notes list the fix as FISH-14190 'Remote Code Execution in JMX'.","status":"open","published_at":"2026-11-12T09:16:40+00:00","first_seen_at":"2026-11-12T09:37:35+00:00","triaged_at":"2026-11-12T09:39:11+00:00","updated_at":"2026-11-12T09:40:33+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T09:39:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Payara Server: spoofed host address grants admin access and remote code execution","impact":"high","summary":"Payara Server and Payara Micro, Java application servers from Azul, have an authentication bypass in the GenericAdminAuthenticator component. A remote attacker can spoof the client host address to get past JMX/RMI admin restrictions, then reach the MBean server and run code.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["payara","java","jmx","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote code execution on the application server with administrative control","analyst_note":"Find the affected and fixed Payara Server and Payara Micro versions and the vendor advisory from Azul; the NVD entry alone does not give ranges or a fix.","how_to_check":"- Check the installed Payara Server or Payara Micro version against the vendor's affected ranges (unknown: the sources do not list them).\n- For Payara Micro, check whether the JMX connector is enabled in its configuration (unknown: the sources do not name the setting).\n- Check whether the JMX/RMI admin port is reachable from untrusted networks (unknown: the sources do not say how to check).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["jmx-connector-disabled","admin-port-not-exposed"],"who_is_affected":"Teams running Payara Server, and Payara Micro when its JMX connector is enabled, are exposed. The attacker needs only network reach to the JMX/RMI admin interface and no login. Systems where the admin interface is not reachable from untrusted networks, or where Payara Micro's JMX connector is off, are not affected according to the description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000783,"input_tokens":4599,"output_tokens":646,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed Payara Server and Payara Micro versions and the vendor advisory from Azul; the NVD entry alone does not give ranges or a fix.","search":"'-2026':19A,22A '-90908':20A,23A 'access':102C,115C 'address':8A,64B,109C 'admin':11A,69B 'administr':101C,114C 'affect':130C 'allow':93C 'applic':44B 'attack':58B,97C 'authent':50B 'azul':47B,86C,90C,126C 'bypass':9A,51B,99C 'client':6A,62B,107C 'code':16A,78B,124C 'compon':55B,84C 'connector':135C 'cve':18A,21A 'enabl':137C 'execut':17A,125C 'exploit':111C 'genericadminauthent':54B,83C 'get':66B 'grant':113C 'host':7A,37B,63B,108C 'java':28B,43B 'jmx':29B,134C 'jmx/rmi':10A,68B,100C 'lead':13A,121C 'mbean':74B,118C 'micro':4A,27A,33B,42B,92C,128C 'past':67B 'payara':1A,24A,26A,30B,32B,38B,41B,87C,91C,127C 'payara-micro':31B 'reach':72B 'remot':15A,57B,95C,123C 'restrict':12A,70B,103C 'run':77B 'runtim':34B 'self':36B 'self-host':35B 'server':2A,25A,39B,45B,75B,88C,119C 'spoof':5A,60B,105C 'success':110C 'unauthent':96C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Any Payara Server or Payara Micro install on the listed older versions that exposes JMX/RMI administration to a network an attacker can reach. A remote unauthenticated attacker can spoof the client host address to get admin access to the MBean server and run code. Payara Micro can skip this if the JMX connector is not enabled; so can any install whose JMX/RMI port is not reachable from untrusted networks.","tier":"B","verified":{"fix":{"at":"2026-11-12T09:40:33Z","by":"analyst","doc":"https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html","run_id":3722}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["micro","payaramicro","payaraserver","server"],"ptokens":["micro","payara","server"],"labels":["critical","java","jmx","payara","payaramicro","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':19A,22A '-90908':20A,23A 'address':8A 'admin':11A 'bypass':9A 'client':6A 'code':16A 'cve':18A,21A 'execut':17A 'host':7A 'jmx/rmi':10A 'lead':13A 'micro':4A,27A 'payara':1A,24A,26A 'remot':15A 'restrict':12A 'server':2A,25A 'spoof':5A","search_b":"'address':64B 'admin':69B 'applic':44B 'attack':58B 'authent':50B 'azul':47B 'bypass':51B 'client':62B 'code':78B 'compon':55B 'genericadminauthent':54B 'get':66B 'host':37B,63B 'java':28B,43B 'jmx':29B 'jmx/rmi':68B 'mbean':74B 'micro':33B,42B 'past':67B 'payara':30B,32B,38B,41B 'payara-micro':31B 'reach':72B 'remot':57B 'restrict':70B 'run':77B 'runtim':34B 'self':36B 'self-host':35B 'server':39B,45B,75B 'spoof':60B","search_c":"'access':102C,115C 'address':109C 'administr':101C,114C 'affect':130C 'allow':93C 'attack':97C 'azul':86C,90C,126C 'bypass':99C 'client':107C 'code':124C 'compon':84C 'connector':135C 'enabl':137C 'execut':125C 'exploit':111C 'genericadminauthent':83C 'grant':113C 'host':108C 'jmx':134C 'jmx/rmi':100C 'lead':121C 'mbean':118C 'micro':92C,128C 'payara':87C,91C,127C 'remot':95C,123C 'restrict':103C 'server':88C,119C 'spoof':105C 'success':110C 'unauthent':96C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T09:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90908","severity":null,"published_at":"2026-11-12T09:16:40+00:00","modified_at":"2026-11-12T09:16:40+00:00","first_seen_at":"2026-11-12T09:37:35+00:00","fetched_at":"2026-11-12T09:37:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-90908:3722","url":"https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html","severity":null,"published_at":"2026-11-12T09:40:33+00:00","modified_at":"2026-11-12T09:40:33+00:00","first_seen_at":"2026-11-12T09:40:33+00:00","fetched_at":"2026-11-12T09:40:33+00:00","note":"Fixed versions from Azul release notes linked by the Payara CNA's NVD entry; notes list FISH-14190 'Remote Code Execution in JMX' without naming the CVE, so the CVE-to-ticket link rests on NVD's references. NVD shows only 5 of 8 affected ranges. No standalone Azul advisory found, no exploitation or PoC seen. X not searched.","cites":["https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html","https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html","https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html","https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html","https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html"]}],"documents":[{"id":133701,"url":"https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html","title":"Azul Payara 7.6.0 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":133702,"url":"https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html","title":"Azul Payara 6.44.0 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":133703,"url":"https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html","title":"Azul Payara 5.93.0 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":133704,"url":"https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html","title":"Azul Payara Community 7.2026.11 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":133705,"url":"https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html","title":"Azul Payara 4.1.2.191.61 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}