---
id: "CVE-2026-90908"
page: "https://infrastack.ai/live/CVE-2026-90908"
kind: "vulnerability"
aliases: ["CVE-2026-90908"]
title: "Payara Server and Micro: spoofed client host address bypasses JMX/RMI admin restrictions, leading to remote code execution"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Payara Server", "fixed": ["7.6.0", "6.44.0", "5.93.0", "4.1.2.191.61", "7.2026.11"], "affected": "< 7.6.0", "ecosystem": "vendor"}, {"name": "Payara Micro", "fixed": ["7.6.0", "6.44.0", "5.93.0", "4.1.2.191.61", "7.2026.11"], "affected": "< 7.6.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["java", "jmx", "payara", "payara-micro", "runtime", "self-hosted"]
not_affected_if: ["admin-port-not-exposed", "jmx-connector-disabled", "jmx-port-not-reachable"]
published_at: "2026-11-12T09:16:40+00:00"
first_seen_at: "2026-11-12T09:37:35+00:00"
updated_at: "2026-11-12T09:40:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90908", "first_seen_at": "2026-11-12T09:37:35+00:00"}, {"source": "analyst", "url": "https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html", "first_seen_at": "2026-11-12T09:40:33+00:00", "cites": ["https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html", "https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html", "https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html", "https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html", "https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html"]}]
exploit_sources: []
---

# Payara Server and Micro: spoofed client host address bypasses JMX/RMI admin restrictions, leading to remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-90908 (this .md is for agents)

Payara Server and Payara Micro, Java application servers from Azul, have an authentication bypass in the GenericAdminAuthenticator component. A remote attacker can spoof the client host address to get past JMX/RMI admin restrictions, then reach the MBean server and run code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Payara Server affected < 7.6.0 fixed 7.6.0, 6.44.0, 5.93.0, 4.1.2.191.61, 7.2026.11
- vendor:Payara Micro affected < 7.6.0 fixed 7.6.0, 6.44.0, 5.93.0, 4.1.2.191.61, 7.2026.11

## How to check

1) Find your version: asadmin version (Server) or java -jar payara-micro.jar --version. Vulnerable if older than 7.6.0, 6.44.0, 5.93.0 or 4.1.2.191.61, or Community 7.2026.11 and earlier (6.2022.1 through 6.2025.11 also listed). 2) Payara Micro is affected only when its JMX connector is enabled; check your start options and config for JMX. 3) Check whether the JMX/RMI admin port is reachable from untrusted networks; if it is, treat it as exposed until patched. Restrict that port with a firewall meanwhile.

## Fix

Upgrade to Azul Payara 7.6.0, 6.44.0, 5.93.0 or 4.1.2.191.61 (Server and Micro), or Payara Community 7.2026.11. Azul's release notes list the fix as FISH-14190 'Remote Code Execution in JMX'.

## Timeline

- 2026-11-12T09:37:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90908
- 2026-11-12T09:40:33+00:00 analyst https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html — Fixed versions from Azul release notes linked by the Payara CNA's NVD entry; notes list FISH-14190 'Remote Code Execution in JMX' without naming the CVE, so the CVE-to-ticket link rests on NVD's references. NVD shows only 5 of 8 affected ranges. No standalone Azul advisory found, no exploitation or PoC seen. X not searched.

## Documents

- [fix] Azul Payara 7.6.0 release notes https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html
- [fix] Azul Payara 6.44.0 release notes https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html
- [fix] Azul Payara 5.93.0 release notes https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html
- [fix] Azul Payara Community 7.2026.11 release notes https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html
- [fix] Azul Payara 4.1.2.191.61 release notes https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html

## From the sources

A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the MBean server and lead to remote code execution. Azul Payara Micro is affected only when its JMX connector is enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_