External risk intelligence

Azul Payara JMX RMI Access Bypass Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-90908

The vulnerability affects JMX/RMI administrative interfaces in Payara Server and Micro. While JMX/RMI is typically an internal management protocol intended for restricted access, it is sometimes inadvertently exposed to the internet or reachable within broader, less-segmented network environments, making reachability possible but not a standard design pattern for public-facing service exposure.

Remote Code Execution

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro, potentially allowing unauthorized administrative access and remote code execution. This issue arises from the ability of an unauthenticated attacker to bypass access restrictions by falsifying client host addresses, which could have significant implications if administrative interfaces are exposed.

Unauthenticated access to administrative functions.
Confirms need for vigilance on access controls.
Assess exposure of administrative interfaces.

Attack Path

How an attacker could exploit the issue

An attacker can bypass administrative access restrictions by spoofing a client's host address, gaining control of the MBean server. This could lead to remote code execution on the affected system.

No authentication or specific user access needed.
Spoofed host address to bypass JMX/RMI restrictions.
Administrative access and potential code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact systems running Azul Payara Server and Azul Payara Micro when the JMX connector is enabled. An unauthenticated remote attacker may bypass administrative access restrictions, potentially leading to unauthorized administrative control over the MBean server and enabling remote code execution.

Administrative access to MBean server.
Bypass JMX/RMI restrictions.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The GenericAdminAuthenticator vulnerability in Azul Payara Server and Micro impacts environments using JMX/RMI for administrative access. Responsibility for remediation likely falls to application owners, platform teams, and potentially security operations if JMX/RMI interfaces are exposed externally or within less segmented networks. The immediate priority is to identify all instances of the affected technology, assess their exposure and business criticality, and confirm the accountable owner to plan a coordinated response.

Application and platform teams own remediation.
Verify JMX/RMI exposure and criticality.
Plan and execute necessary updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Azul Payara Server and Payara Micro?

These are Java-based application server platforms used to build, deploy, and manage enterprise Jakarta EE applications. They provide the runtime environment for Java code and often include administrative interfaces, like JMX/RMI, to help developers and system administrators monitor server health, manage resources, and perform configuration tasks remotely.

How does this CVE-2026-90908 vulnerability work?

This issue is a form of an untrusted input vulnerability, specifically classified as CWE-807: Reliance on Untrusted Inputs in a Security Decision. The component responsible for verifying administrative access incorrectly trusts the client's reported host address. By spoofing this address, an attacker can trick the system into believing they are a trusted administrator, bypassing authentication checks to gain control over the MBean server.

Can any Azul Payara system be exploited?

Not every configuration is immediately affected. For Payara Micro users, this vulnerability only triggers if the JMX connector is explicitly enabled. If the JMX connector is disabled, the specific code path that fails to validate the host address is not active, which prevents the bypass from occurring.

Is my system at risk if it is not on the internet?

Halo Surface Signal notes that while JMX/RMI is designed for internal management, it is often reachable within broader, less-segmented networks. Even if your server is not directly on the internet, attackers who gain a foothold inside your network may be able to reach these administrative interfaces if they are not properly restricted, making internal exposure a valid concern.

What should I do if I run Azul Payara?

First, locate all running instances of Payara Server and Payara Micro to determine where they are deployed. Next, audit your environment to see if the JMX/RMI interface is enabled and whether those ports are accessible to unauthorized users. Finally, coordinate with your platform or application teams to review official vendor release notes to identify and apply the necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.