CVE-2026-12986 json
Payara Server Full has a Cross-Site Request Forgery vulnerability
published 2026-06-24 4 mo ago modified 2026-10-25 14 d ago also GHSA-x939-7fq5-v9v6 , EUVD-2026-38793
- cvss
- 7.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain.
A Server-Side Request Forgery (SSRF) vulnerability in the DownloadServlet of the Admin GUI in Payara Server allows a remote attacker to exfiltrate the administrator's REST session token (gfresttoken) to an attacker-controlled host via a crafted request URL. Combined with the absence of CSRF protection on DownloadServlet, an unauthenticated attacker can trick a logged-in administrator into triggering the token leak, then replay the stolen token to gain full administrative access to the Payara domain, leading to arbitrary code execution via WAR deployment. The vulnerability exists in the DownloadServlet and associated ContentSource implementations (LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, ClientStubsContentSource) within the admingui:console-common module.
Patch / fix
- maven fish.payara.distributions:payara 7.2026.6
- Payara Payara Server 4.1.2.191.56, 5.88.0, 6.39.0, 7.1.0, 7.2026.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.3 | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:P/AU:Y/R:U/V:C/RE:M/U:Amber |
| CNA | 4.0 | 7.3 | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Amber |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | fish.payara.distributions:payara | >=4.0.0, <7.2026.6 |
7.2026.6 |
Affected products
- Payara Payara Server
Classification
References
-
github.com
/payara/Payara/pull/8229
web
-
github.com
/payara/Payara/commit/be83ab093692bafb09125323f3fdefaeab9cc398
web
-
docs.payara.fish
/community/docs/Release%20Notes/Release%20Notes%207.2026.6.html
release-notes, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-12986
advisory
-
github.com
/payara/Payara
package
-
github.com
/payara/Payara/releases/tag/payara-server-7.2026.6
web
Sources
- CVE List CVE-2026-12986
- GitHub Advisory GHSA-x939-7fq5-v9v6
- NVD CVE-2026-12986
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.