CVE-2026-92082

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see  https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

Score

CVSS 4.0 6.3 Medium

Status

Deferred - 769c9ae7-73c3-4e47-ae19-903170fc3eb8

Published

2026-09-15

Last modified

2026-09-15

Weaknesses

CWE-307

Affected products

• Payara Server (Payara)

References

• https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html
• https://docs.azul.com/payara/release-notes/release-notes-7.2.0.html
• https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.57.html
• https://docs.azul.com/payara/version/5/release-notes/release-notes-5.89.0.html
• https://docs.azul.com/payara/version/6/release-notes/release-notes-6.40.0.html