Azul Payara Server and Micro: Unauthenticated Remote Code Execution (CVE-2026-90908)
Azul Payara Server and Payara Micro are vulnerable to unauthenticated remote code execution via a JMX/RMI authentication bypass in the GenericAdminAuthenticator component (CVE-2026-90908).
CVE search metadata
CVE search record: CVE-2026-90908. KEV: no. Product: Payara Server, Payara Micro. Brief: Azul Payara Server and Micro: Unauthenticated Remote Code Execution (CVE-2026-90908). Brief link: https://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-90908/
Triage facts
Revision 1- Applicability
- Payara Server, Payara Micro
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 7 public sources
- Freshness
- Revision 1Nov 12, 13:24 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Very likely
CVE-2026-90908 is a critical vulnerability identified in the GenericAdminAuthenticator component of Azul Payara Server and Payara Micro. The flaw allows a remote, unauthenticated attacker to bypass administrative authentication restrictions for JMX/RMI by spoofing the client host address. Successful exploitation provides administrative access to the MBean server, enabling full remote code execution. Azul Payara Micro is only affected when the JMX connector is enabled.
Impact
Successful exploitation results in unauthenticated administrative access to the MBean server, which can be leveraged to achieve remote code execution on the underlying host, potentially leading to full system compromise.
Recommendation
- Audit all exposed Payara Server and Micro instances for JMX/RMI access.
- Ensure the JMX connector is disabled for Payara Micro instances unless strictly required.
- Consult the Azul Payara release notes (referenced) to identify and apply the necessary version updates that remediate CVE-2026-90908.
- Monitor network traffic to Payara administration interfaces for unauthorized access attempts.
Immediate actions
Inventory all Azul Payara Server and Micro instances in the environment.
Disable JMX connector on Payara Micro instances if not required.
Threat Hunt
Hunt for unauthorized RMI/JMX connection attempts or anomalous source IP patterns directed at Payara administrative interfaces.
Data: Network traffic logs, Payara server application logs