Payara vulnerabilities

Products

• Payara 6
• Server 2

Newest

• payara server Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts CVE-2026-92082 6.3 MediumSeptember 15, 2026
• payara server Payara Server Full has a Cross-Site Request Forgery vulnerability CVE-2026-12986 Fix available 7.3 HighJune 24, 2026
• payara, payara platform server +1 more Cross-site Scripting (Stored) CVE-2025-1534 6.8 MediumApril 1, 2025
• payara, payara platform server +1 more Payload Injection Attack via Management REST interface CVE-2024-8215 8.7 HighOctober 8, 2024
• payara, payara platform server +1 more REST Interface Link Redirection via Host parameter CVE-2024-7312 7.0 HighSeptember 11, 2024
• payara, payara platform server, micro and embedded +1 more Payara Platform: URL Redirection to untrusted site using FORM authentication CVE-2023-41699 6.1 MediumNovember 15, 2023
• payara server Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed CVE-2023-28462 Fix available 9.8 CriticalMarch 30, 2023
• payara Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF CVE-2022-45129 Fix available 7.5 HighNovember 10, 2022
• payara Path Traversal in Payara CVE-2022-37422 Public exploitFix available 7.5 HighAugust 18, 2022
• payara micro community Payara Micro Community 5.2021.6 and below allows Directory Traversal. CVE-2021-41381 Public exploit EPSS 52.9% 7.5 HighSeptember 23, 2021