Product

Payara Server

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 4, 2026 · last 11d ago

Timeline2 articles

Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server

Payara Server 7.2026.1.RC1 executes arbitrary OS commands when user-controlled Server-Side Includes #exec directives are passed to Runtime.exec without validation.

Payara Server contains a vulnerability in its Server-Side Includes (SSI) implementation that permits arbitrary operating system command execution via the #exec directive. User-controlled SSI directives are passed directly to Runtime.exec() without validation, sanitization, or restriction. An attacker who can cause the server to process an SSI file such as .shtml can execute arbitrary OS commands. The disclosed affected version is 7.2026.1.RC1.

Full DisclosureSep 4, 00:13 UTC · 11d agoVulnerability 2 sources

Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server

Payara Server 7.2026.1.RC1 HTTP EJB endpoints rely on attacker-controlled reflection and JNDI lookups without authorization, enabling arbitrary EJB method invocation.

Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that depend on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. Remote clients can perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods without sufficient authorization enforcement or input restriction. Both the deprecated InvokeEJBServlet and other endpoints are affected in version 7.2026.1.RC1.

Full DisclosureSep 4, 00:13 UTC · 11d agoVulnerability 2 sources

Appears with

vendor Payara 2

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.