Remote Code Execution Vulnerability in Azul Payara Server and Micro

CVE-2026-90908

What is CVE-2026-90908?

A vulnerability exists in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro, enabling remote, unauthenticated attackers to bypass administrative access restrictions associated with JMX/RMI. This is achieved by spoofing the client host address. If exploited, attackers can gain unauthorized administrative access to the MBean server, potentially leading to harmful remote code execution. Notably, Azul Payara Micro is especially susceptible when its JMX connector is activated.

References