Azul Payara: Unauthenticated remote code execution via administrative REST interface (CVE-2026-110003)
A public proof-of-concept exploit exists for CVE-2026-110003, a critical vulnerability in the administration REST interface of Azul Payara that allows unauthenticated remote code execution.
CVE search metadata
CVE search record: CVE-2026-110003. KEV: no. Product: Payara. Brief: Azul Payara: Unauthenticated remote code execution via administrative REST interface (CVE-2026-110003). Brief link: https://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-110003/
Triage facts
Revision 1- Applicability
- Payara
- Evidence
- Not observed
- Severity
- Critical
- Sources
- 6 public sources
- Freshness
- Revision 1Nov 12, 13:24 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-110003 is a vulnerability in the administration REST interface of Azul Payara that allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. An invalid token can result in the request falling through to password-based authentication, which succeeds on default domains configured with an empty administrative password.
Impact
Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.
Recommendation
Review the vendor release notes for patches and update affected Payara installations.
Detection coverage 1
Detect CVE-2026-110003 Exploitation Attempt
highDetects HTTP requests to the Payara administration REST interface containing the X-GlassFish-authToken header, which is associated with CVE-2026-110003.
Detection queries are available on the platform. Get full rules →