CVE-2026-92082

MediumCVSS 6.3/10Last modified Sep 18, 2026

Description

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .

Metrics

CVSS 4.0 6.3/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Amber

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
Payara	Payara Server	>= 7.0.0, < 7.2.0; >= 7.2025.1, < 7.2026.7; >= 6.0.0, < 6.40.0; >= 5.20.0, < 5.89.0; >= 4.1.144, < 4.1.2.191.57; 6.2023.1; 5.2020.1

References

Timeline

Published: Sep 15, 2026
Last modified: Sep 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-920837.8Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalat CVE-2026-920849.1The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in a CVE-2026-920855.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. L CVE-2026-920865.3The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'pos CVE-2026-920878.1@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions CVE-2026-920888.6Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. Th CVE-2026-92099.8mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the r CVE-2026-920915.9A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(CVE-2026-920927.4A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts wi CVE-2026-920979.1The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 Th CVE-2026-920986.1The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_prin CVE-2026-920996.5The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before