CVE-2026-92082: Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable Payara Server's built-in automatic attack protection to mitigate brute-force login attacks caused by the default absence of a limit on failed login attempts.
Payara Server built-in automatic attack protection (failed login brute force mitigation) = enable
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Payara Server deployments are exposed by default because failed login attempts are not limited unless protective controls are configured.
What does an attacker need to exploit this issue?
An attacker needs the ability to submit repeated login attempts against Payara Server. The issue enables brute-force attempts because there is no default limit on failed logins.
What can be done if an update is not immediately possible?
Enable and configure Payara Server's built-in automatic attack protection to mitigate repeated failed login attempts.