All vulnerabilities
CVE-2026-12986GHSA-x939-7fq5-v9v6

fish.payara.distributions:payara: Payara Server Full has a Cross-Site Request Forgery vulnerability

Payara fish.payara.distributions:payaramavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.2026.6Also 7.1.0, 6.39.0 and 2 moreGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 7.2026.6fish.payara.distributions:payara, mavenGitHub<dependency><groupId>fish.payara.distributions</groupId><artifactId>payara</artifactId><version>7.2026.6</version></dependency>
  • 7.2026.6Payara ServerCVE List
  • 7.1.0Payara ServerCVE List
  • 6.39.0Payara ServerCVE List
  • 5.88.0Payara ServerCVE List
  • 4.1.2.191.56Payara ServerCVE List
Show all 7 fixed versions
  • 7.2026.6fish.payara.distributions:payara, MavenOSV<dependency><groupId>fish.payara.distributions</groupId><artifactId>payara</artifactId><version>7.2026.6</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain.

A Server-Side Request Forgery (SSRF) vulnerability in the DownloadServlet of the Admin GUI in Payara Server allows a remote attacker to exfiltrate the administrator's REST session token (gfresttoken) to an attacker-controlled host via a crafted request URL. Combined with the absence of CSRF protection on DownloadServlet, an unauthenticated attacker can trick a logged-in administrator into triggering the token leak, then replay the stolen token to gain full administrative access to the Payara domain, leading to arbitrary code execution via WAR deployment. The vulnerability exists in the DownloadServlet and associated ContentSource implementations (LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, ClientStubsContentSource) within the admingui:console-common module.

Text from GitHub Advisory Database

Affected versions 60

  • fish.payara.distributions:payara, maven>= 4.0.0, < 7.2026.6GitHub
  • Payara Serveraffected: 7.2025.1 before 7.2026.6CVE List
  • Payara Serveraffected: 7.0.0 before 7.1.0CVE List
  • Payara Serveraffected: 6.0.0 before 6.39.0CVE List
  • Payara Serveraffected: 5.20.0 before 5.88.0CVE List
  • Payara Serveraffected: 4.1.144 before 4.1.2.191.56CVE List
  • Payara Serveraffected: 5.181 through 5.201.2CVE List
  • Payara Serveraffected: 5.2020.1 through 5.2022.5CVE List
  • Payara Serveraffected: 6.2023.1 through 6.2025.11CVE List
  • fish.payara.distributions:payara, Mavenfrom 4.0.0, fixed in 7.2026.6OSV
  • fish.payara.distributions:payara, Maven4.1.1.161OSV
  • fish.payara.distributions:payara, Maven4.1.1.161.1OSV
  • fish.payara.distributions:payara, Maven4.1.1.162OSV
  • fish.payara.distributions:payara, Maven4.1.1.163OSV
  • fish.payara.distributions:payara, Maven4.1.1.164OSV
  • fish.payara.distributions:payara, Maven4.1.1.171OSV
  • fish.payara.distributions:payara, Maven4.1.1.171.0.1OSV
  • fish.payara.distributions:payara, Maven4.1.1.171.1OSV
  • fish.payara.distributions:payara, Maven4.1.2.172OSV
  • fish.payara.distributions:payara, Maven4.1.2.173OSV
  • fish.payara.distributions:payara, Maven4.1.2.174OSV
  • fish.payara.distributions:payara, Maven4.1.2.181OSV
  • fish.payara.distributions:payara, Maven5.0.0.Alpha1OSV
  • fish.payara.distributions:payara, Maven5.0.0.Alpha2OSV
  • fish.payara.distributions:payara, Maven5.0.0.Alpha3OSV
  • fish.payara.distributions:payara, Maven5.181OSV
  • fish.payara.distributions:payara, Maven5.182OSV
  • fish.payara.distributions:payara, Maven5.183OSV
  • fish.payara.distributions:payara, Maven5.184OSV
  • fish.payara.distributions:payara, Maven5.191OSV
  • fish.payara.distributions:payara, Maven5.192OSV
  • fish.payara.distributions:payara, Maven5.193OSV
  • fish.payara.distributions:payara, Maven5.193.1OSV
  • fish.payara.distributions:payara, Maven5.194OSV
  • fish.payara.distributions:payara, Maven5.201OSV
  • fish.payara.distributions:payara, Maven5.2020.2OSV
  • fish.payara.distributions:payara, Maven5.2020.3OSV
  • fish.payara.distributions:payara, Maven5.2020.4OSV
  • fish.payara.distributions:payara, Maven5.2020.5OSV
  • fish.payara.distributions:payara, Maven5.2020.6OSV
  • fish.payara.distributions:payara, Maven5.2020.7OSV
  • fish.payara.distributions:payara, Maven5.2021.1OSV
  • fish.payara.distributions:payara, Maven5.2021.10OSV
  • fish.payara.distributions:payara, Maven5.2021.2OSV
  • fish.payara.distributions:payara, Maven5.2021.3OSV
  • fish.payara.distributions:payara, Maven5.2021.4OSV
  • fish.payara.distributions:payara, Maven5.2021.5OSV
  • fish.payara.distributions:payara, Maven5.2021.6OSV
  • fish.payara.distributions:payara, Maven5.2021.7OSV
  • fish.payara.distributions:payara, Maven5.2021.8OSV
  • fish.payara.distributions:payara, Maven5.2021.9OSV
  • fish.payara.distributions:payara, Maven5.2022.1OSV
  • fish.payara.distributions:payara, Maven5.2022.2OSV
  • fish.payara.distributions:payara, Maven5.2022.3OSV
  • fish.payara.distributions:payara, Maven5.2022.4OSV
  • fish.payara.distributions:payara, Maven5.2022.5OSV
  • fish.payara.distributions:payara, Maven5.Beta1OSV
  • fish.payara.distributions:payara, Maven5.Beta2OSV
  • fish.payara.distributions:payara, Maven6.2021.1.Alpha1OSV
  • fish.payara.distributions:payara, Maven6.2022.1OSV

References 6