CVE-2026-92082

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

CVSS

No CVSS.

References

Link	Resource
https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html
https://docs.azul.com/payara/release-notes/release-notes-7.2.0.html
https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.57.html
https://docs.azul.com/payara/version/5/release-notes/release-notes-5.89.0.html
https://docs.azul.com/payara/version/6/release-notes/release-notes-6.40.0.html

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-15 15:17

Updated : 2026-09-15 15:17

NVD link : CVE-2026-92082

Mitre link : CVE-2026-92082

CVE.ORG link : CVE-2026-92082

JSON object : View

Products Affected

No product.

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-92082", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92082", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-15T14:58:27.927898Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 6.3, "Automatable": "YES", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8", "affectedData": [{"repo": "https://github.com/payara/Payara/", "vendor": "Payara", "modules": ["Admin GUI"], "product": "Payara Server", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.2.0", "versionType": "semver"}, {"status": "affected", "version": "7.2025.1", "lessThan": "7.2026.7", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.40.0", "versionType": "semver"}, {"status": "affected", "version": "5.20.0", "lessThan": "5.89.0", "versionType": "semver"}, {"status": "affected", "version": "4.1.144", "lessThan": "4.1.2.191.57", "versionType": "custom"}, {"status": "affected", "version": "6.2023.1", "versionType": "custom"}, {"status": "affected", "version": "5.2020.1", "versionType": "custom"}], "packageName": "org.glassfish.admingui.common.security", "programFiles": ["org.glassfish.admingui.common.security.AdminConsoleAuthModule"], "defaultStatus": "affected"}]}], "published": "2026-09-15T15:17:33.317", "references": [{"url": "https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html", "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"}, {"url": "https://docs.azul.com/payara/release-notes/release-notes-7.2.0.html", "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"}, {"url": "https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.57.html", "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"}, {"url": "https://docs.azul.com/payara/version/5/release-notes/release-notes-5.89.0.html", "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"}, {"url": "https://docs.azul.com/payara/version/6/release-notes/release-notes-6.40.0.html", "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see\u00a0 https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html ."}], "lastModified": "2026-09-15T15:17:33.317", "sourceIdentifier": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"}