Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-92082

Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Payara

Description

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see  https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Payara Payara Server

Default version status: affected

  • 7.0.0 to < 7.2.0affected
  • 7.2025.1 to < 7.2026.7affected
  • 6.0.0 to < 6.40.0affected
  • 5.20.0 to < 5.89.0affected
  • 4.1.144 to < 4.1.2.191.57affected
  • 6.2023.1affected
  • 5.2020.1affected

References