Vulnerability · Published Sep 15, 2026 · Assigned by Payara
CVE-2026-92082Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts
Medium 6.3
In plain English
A medium-severity security flaw in Payara Server from Payara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Payara | Payara Server | 7.0.0 – before 7.2.07.2025.1 – before 7.2026.76.0.0 – before 6.40.05.20.0 – before 5.89.04.1.144 – before 4.1.2.191.576.2023.15.2020.1 |
Weakness: CWE-307 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Amber
References
- https://docs.azul.com/payara/release-notes/release-notes-7.2.0.html release-notes
- https://docs.azul.com/payara/version/6/release-notes/release-notes-6.40.0.html release-notes
- https://docs.azul.com/payara/version/5/release-notes/release-notes-5.89.0.html release-notes
- https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.57.html release-notes
- https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html release-notes