CVE-2026-92082CWE-307

CVE-2026-92082

published September 15, 2026

CVSS
6.3
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see  https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
6.3 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Amber
EPSS
0.00300 · 21.6th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-09-15T19:17Z
References (5)
https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.7.html · 769c9ae7-73c3-4e47-ae19-903170fc3eb8https://docs.azul.com/payara/release-notes/release-notes-7.2.0.html · 769c9ae7-73c3-4e47-ae19-903170fc3eb8https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.57.html · 769c9ae7-73c3-4e47-ae19-903170fc3eb8https://docs.azul.com/payara/version/5/release-notes/release-notes-5.89.0.html · 769c9ae7-73c3-4e47-ae19-903170fc3eb8https://docs.azul.com/payara/version/6/release-notes/release-notes-6.40.0.html · 769c9ae7-73c3-4e47-ae19-903170fc3eb8
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 14:04Z
    Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts
    cvelistv5