CVE-2026-92082
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection.
Risk Assessment
The lack of a limit on failed login attempts allows an attacker to conduct brute force attacks to gain unauthorized access to accounts.
Recommendation
Configure Payara Server's built-in automatic attack protection according to the security documentation to limit failed login attempts.
Other vulnerabilities in Payara Server
Original NVD description (English source)
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS