Azul has patched two critical security flaws in Payara Server and Payara Micro that allow an unauthenticated attacker to seize full administrative control of a server. Both flaws, tracked as CVE-2026-110003 and CVE-2026-90908, carry CVSS scores of 9.3 and were published on 12 November 2026.

What the two flaws allow

The first flaw, CVE-2026-110003, sits in the administration REST interface. Payara checked whether an X-GlassFish-authToken header was present before verifying whether the token was genuine, so sending any value in that header bypassed the check that blocks remote administration when secure admin is disabled. The request then fell through to password authentication, which succeeds with no password on default domains configured with an empty admin password, granting full remote administrative command execution on port 4848.

The second flaw, CVE-2026-90908, affects JMX administration over RMI. An attacker could supply a three-element credentials array with “localhost” as the third element, tricking Payara into treating the remote connection as local. That grants administrative JMX access, which can be used to run arbitrary code as the Payara service account.

Who is affected and how to fix it

Payara Community versions before 7.2026.11 are affected, along with Payara Enterprise versions before 7.6.0, 6.44.0, 5.93.0 and 4.1.2.191.61. Administrators should update to a patched release, set a strong administrative password rather than relying on the default, and never expose the admin ports 4848 and 8686 to the internet. No exploitation in the wild has been reported for either flaw.

Sources: Azul Payara security advisories | Corgea research, 12 November 2026