Cpe:2.3:a:azul:payara:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aazulpayara/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 13:24:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAzul Payara: Unauthenticated remote code execution via administrative REST interface (CVE-2026-110003)https://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-110003/Thu, 12 Nov 2026 13:24:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-110003/A public proof-of-concept exploit exists for CVE-2026-110003, a critical vulnerability in the administration REST interface of Azul Payara that allows unauthenticated remote code execution.CVE-2026-110003 is a vulnerability in the administration REST interface of Azul Payara that allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. An invalid token can result in the request falling through to password-based authentication, which succeeds on default domains configured with an empty administrative password.

Impact

Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.

Recommendation

Review the vendor release notes for patches and update affected Payara installations.

]]>criticaladvisory