CVE-2026-92082 Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts
Attackers can brute-force login credentials because Payara Server lacks default failed login attempt limits, requiring configuration of built-in protection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92082?
CVE-2026-92082 is a medium-severity vulnerability in Payara Server, published on 15 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see https://docs.azul.com/payara/technical-documentation/payara-server-documentation/security-guide/administering-system-security.html .
Weakness: CWE-307
Which versions are affected by CVE-2026-92082?
How do I fix CVE-2026-92082?
No fix has been published for CVE-2026-92082 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92082 being exploited?
There is no known exploitation of CVE-2026-92082 in the wild and no public exploit code.
Sources
Also known as GHSA-mwf3-qj4r-2qq4.