CVE-2026-92082: Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

Medium severity · published Sep 15, 2026

CVE-2026-92082

Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

6.3

CVSS

0.3%

EPSS

On KEV

Description

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 23% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Payara Server · Payara

7.0.0 before 7.2.0; 7.2025.1 before 7.2026.7; 6.0.0 before 6.40.0; 5.20.0 before 5.89.0; 4.1.144 before 4.1.2.191.57; 6.2023.1; +1 more · source: vendor

Affected product

Payara Server

Payara

All Payara Server CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-92082

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-92082

docs.azul.com

https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html

docs.azul.com