{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/azul/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:azul:payara:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-110003"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Payara"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Azul"],"content_html":"\u003cp\u003eCVE-2026-110003 is a vulnerability in the administration REST interface of Azul Payara that allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. An invalid token can result in the request falling through to password-based authentication, which succeeds on default domains configured with an empty administrative password.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eReview the vendor release notes for patches and update affected Payara installations.\u003c/p\u003e\n","date_modified":"2026-11-12T13:24:15Z","date_published":"2026-11-12T13:24:15Z","id":"https://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-110003/","summary":"A public proof-of-concept exploit exists for CVE-2026-110003, a critical vulnerability in the administration REST interface of Azul Payara that allows unauthenticated remote code execution.","title":"Azul Payara: Unauthenticated remote code execution via administrative REST interface (CVE-2026-110003)","url":"https://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-110003/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-90908"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Payara Server","Payara Micro"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Azul"],"content_html":"\u003cp\u003eCVE-2026-90908 is a critical vulnerability identified in the GenericAdminAuthenticator component of Azul Payara Server and Payara Micro. The flaw allows a remote, unauthenticated attacker to bypass administrative authentication restrictions for JMX/RMI by spoofing the client host address. Successful exploitation provides administrative access to the MBean server, enabling full remote code execution. Azul Payara Micro is only affected when the JMX connector is enabled.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthenticated administrative access to the MBean server, which can be leveraged to achieve remote code execution on the underlying host, potentially leading to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all exposed Payara Server and Micro instances for JMX/RMI access.\u003c/li\u003e\n\u003cli\u003eEnsure the JMX connector is disabled for Payara Micro instances unless strictly required.\u003c/li\u003e\n\u003cli\u003eConsult the Azul Payara release notes (referenced) to identify and apply the necessary version updates that remediate CVE-2026-90908.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic to Payara administration interfaces for unauthorized access attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T13:24:05Z","date_published":"2026-11-12T13:24:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-90908/","summary":"Azul Payara Server and Payara Micro are vulnerable to unauthenticated remote code execution via a JMX/RMI authentication bypass in the GenericAdminAuthenticator component (CVE-2026-90908).","title":"Azul Payara Server and Micro: Unauthenticated Remote Code Execution (CVE-2026-90908)","url":"https://feed.craftedsignal.io/briefs/2026-11-payara-rce-cve-2026-90908/"}],"language":"en","title":"CraftedSignal Threat Feed - Azul","version":"https://jsonfeed.org/version/1.1"}