How many CVEs does payara Payara Server have?

payara Payara Server has 3 published CVE records since 2023.

How many payara Payara Server CVEs are in CISA KEV?

None of payara Payara Server's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of payara Payara Server are affected?

28 distinct payara Payara Server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in payara Payara Server CVEs?

payara Payara Server's CVEs most often map to these CWE weakness types: CWE-307 (Improper Restriction of Excessive Authentication Attempts), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-502 (Deserialization of Untrusted Data).

How many critical payara Payara Server vulnerabilities are there?

payara Payara Server has 1 critical and 1 high-severity CVEs.

What is the average severity of payara Payara Server CVEs?

The average CVSS base score across payara Payara Server's scored CVEs is 7.8.

RadicalNotion.AI

Log in Create an account

payara

3 CVEs

Payara Server Vulnerabilities

Name: Payara Server vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Payara Server by payara.

3

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

7.8

Avg CVSS

2023–2026

Last updated September 15, 2026

Overview

Payara Server has 3 published CVE records since 2023, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.8. Affected platforms include jdk, linux, macos, windows.

Severity and exploitation

How the CVSS severity of Payara Server's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High1

Medium1

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Payara Server's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No Payara Server CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every Payara Server version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

5.2020.11 CVE
6.2023.11 CVE

Version ranges

>= 5.20.01 CVE
>= 5.2020.11 CVE
4.1.144 <= v < 4.1.2.191.561 CVE
4.1.144 <= v < 4.1.2.191.571 CVE
4.1.2.191 <= v <= 5.0.01 CVE
5.181 <= v <= 5.201.21 CVE
5.20.0 <= v < 5.88.01 CVE
5.20.0 <= v < 5.89.01 CVE
5.2020.1 <= v <= 5.2022.51 CVE
6.0.0 <= v < 6.39.01 CVE
6.0.0 <= v < 6.40.01 CVE
6.2023.1 <= v <= 6.2025.111 CVE
7.0.0 <= v < 7.1.01 CVE
7.0.0 <= v < 7.2.01 CVE
7.2025.1 <= v < 7.2026.61 CVE
7.2025.1 <= v < 7.2026.71 CVE

Fixed in

4.1.2.191.561 CVE
4.1.2.191.571 CVE
5.88.01 CVE
5.89.01 CVE
6.39.01 CVE
6.40.01 CVE
7.1.01 CVE
7.2.01 CVE
7.2026.61 CVE
7.2026.71 CVE

Find a version

3 CVEs

Sort

Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts
CVE-2026-92082
Patch
CWE-307
Medium · CVSS 6.3
EPSS 0.3% (21th pct)2026-09-15
Payara Server Full has a Cross-Site Request Forgery vulnerability
CVE-2026-12986
Patch
CWE-352
High · CVSS 7.3
EPSS 0.3% (19th pct)2026-06-24
Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed
CVE-2023-28462
Patch
CWE-502
Critical · CVSS 9.8
EPSS 0.9% (60th pct)2023-03-30

Common weakness types

The CWE weakness categories most often found in Payara Server CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Payara Server CVEs were published each year.

2023

1

2026

2

Other payara products

Browse vulnerabilities for other products by payara.

payara7 CVEs fish.payara.distributions:payara2 CVEs fish.payara.server:payara-aggregator1 CVEs micro community1 CVEs

All payara vulnerabilities

Frequently asked questions

Common questions about Payara Server vulnerabilities.

How many CVEs does payara Payara Server have?: payara Payara Server has 3 published CVE records since 2023.
How many payara Payara Server CVEs are in CISA KEV?: None of payara Payara Server's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for payara Payara Server vulnerabilities?: No payara Payara Server CVEs currently have a tracked public exploit in this dataset.
Which versions of payara Payara Server are affected?: 28 distinct payara Payara Server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in payara Payara Server CVEs?: payara Payara Server's CVEs most often map to these CWE weakness types: CWE-307 (Improper Restriction of Excessive Authentication Attempts), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-502 (Deserialization of Untrusted Data).
How many critical payara Payara Server vulnerabilities are there?: payara Payara Server has 1 critical and 1 high-severity CVEs.
What is the average severity of payara Payara Server CVEs?: The average CVSS base score across payara Payara Server's scored CVEs is 7.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Payara Server vulnerabilities

Get an alert for each new Payara Server CVE, with AI-written analysis and remediation steps.

Create an account See pricing