What’s Vulnerable › Vulnerabilities

CVE-2026-92082: Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

• Severity: medium (CVSS 6.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-18
• Weakness: CWE-307

Description

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see  https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

Affected products

• Payara Server: from 7.0.0 before 7.2.0; from 7.2025.1 before 7.2026.7; from 6.0.0 before 6.40.0; from 5.20.0 before 5.89.0; from 4.1.144 before 4.1.2.191.57; 6.2023.1, 5.2020.1 — fixed in 4.1.2.191.57, 5.89.0, 6.40.0, 7.2.0, 7.2026.7

How to fix

Upgrade to a fixed version: Payara Server 4.1.2.191.57, 5.89.0, 6.40.0, 7.2.0. Check the vendor advisory for mitigations.

References

• https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html
• https://docs.azul.com/payara/release-notes/release-notes-7.2.0.html
• https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.57.html
• https://docs.azul.com/payara/version/5/release-notes/release-notes-5.89.0.html
• https://docs.azul.com/payara/version/6/release-notes/release-notes-6.40.0.html

Get alerted when CVE-2026-92082 or the next vulnerability affects your stack