Critical
9.3
A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara...
CVE-2026-90908
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Azul PayaraPayara Server |
≥ 7.0.0, < 7.6.0→ 7.6.0 ≥ 7.2024.1.Alpha1, < 7.2026.11→ 7.2026.11 ≥ 6.0.0, < 6.44.0→ 6.44.0 6.2022.1 – 6.2025.11→ Not listed ≥ 5.20.0, < 5.93.0→ 5.93.0 5.181 – 5.201.2→ Not listed 5.2020.2 – 5.2022.5→ Not listed ≥ 4.1.2.191, < 4.1.2.191.61→ 4.1.2.191.61 |
7.6.0 7.2026.11 6.44.0 Not listed 5.93.0 Not listed Not listed 4.1.2.191.61 |
| Azul PayaraPayara Micro |
≥ 7.0.0, < 7.6.0→ 7.6.0 ≥ 7.2024.1.Alpha1, < 7.2026.11→ 7.2026.11 ≥ 6.0.0, < 6.44.0→ 6.44.0 6.2022.1 – 6.2025.11→ Not listed ≥ 5.20.0, < 5.93.0→ 5.93.0 5.181 – 5.201.2→ Not listed 5.2020.2 – 5.2022.5→ Not listed ≥ 4.1.1.154.1, < 4.1.2.191.61→ 4.1.2.191.61 |
7.6.0 7.2026.11 6.44.0 Not listed 5.93.0 Not listed Not listed 4.1.2.191.61 |
Original description The description as published by the source.
A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the MBean server and lead to remote code execution. Azul Payara Micro is affected only when its JMX connector is enabled.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web docs.azul.com
- web docs.azul.com
- web docs.azul.com
- web docs.azul.com
- web docs.azul.com
- web nvd.nist.gov
- web github.com