Payara Micro - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/payara-micro/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 13:24:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAzul Payara Server and Micro: Unauthenticated Remote Code Execution (CVE-2026-90908)https://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-90908/Thu, 12 Nov 2026 13:24:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-90908/Azul Payara Server and Payara Micro are vulnerable to unauthenticated remote code execution via a JMX/RMI authentication bypass in the GenericAdminAuthenticator component (CVE-2026-90908).CVE-2026-90908 is a critical vulnerability identified in the GenericAdminAuthenticator component of Azul Payara Server and Payara Micro. The flaw allows a remote, unauthenticated attacker to bypass administrative authentication restrictions for JMX/RMI by spoofing the client host address. Successful exploitation provides administrative access to the MBean server, enabling full remote code execution. Azul Payara Micro is only affected when the JMX connector is enabled.

Impact

Successful exploitation results in unauthenticated administrative access to the MBean server, which can be leveraged to achieve remote code execution on the underlying host, potentially leading to full system compromise.

Recommendation

  • Audit all exposed Payara Server and Micro instances for JMX/RMI access.
  • Ensure the JMX connector is disabled for Payara Micro instances unless strictly required.
  • Consult the Azul Payara release notes (referenced) to identify and apply the necessary version updates that remediate CVE-2026-90908.
  • Monitor network traffic to Payara administration interfaces for unauthorized access attempts.
]]>criticaladvisory