Payara Server 7.2026.1.RC1: Arbitrary EJB Method Invocation via Insecure Reflection and OS Command Execution via SSI #exec Directive

Two same-day full disclosures (2026-09-04) affect Payara Server 7.2026.1.RC1: HTTP EJB endpoints allow arbitrary EJB method invocation through attacker-controlled reflection, dynamic class loading, unsafe deserialization, and arbitrary JNDI lookups without…

Two separate full-disclosure reports, both published on 2026-09-04, describe vulnerabilities in the same product and version: Payara Server 7.2026.1.RC1. The first describes HTTP-accessible EJB invocation mechanisms that depend on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. Remote clients can perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods without sufficient authorization enforcement or input restriction; both the deprecated InvokeEJBServlet and other endpoints are affected in version 7.2026.1.RC1. The second describes a flaw in Payara Server's Server-Side Includes (SSI) implementation: user-controlled SSI directives, specifically #exec, are passed directly to Runtime.exec() without validation, sanitization, or restriction. An attacker who can cause the server to process an SSI file such as .shtml can execute arbitrary operating system commands. Neither report provides a CVE identifier, and there are no factual disagreements between the two reports; they describe distinct issues affecting the same disclosed version.

• Affected product and version (stated in both reports): Payara Server 7.2026.1.RC1
• Disclosure type and date (both reports): Full Disclosure, published 2026-09-04 (timestamps 2026-09-04T00:13:07.000Z and 2026-09-04T00:13:09.000Z)
• EJB issue: HTTP-accessible EJB invocation mechanisms rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization
• EJB issue: Remote clients can perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods without sufficient authorization enforcement or input restriction
• EJB issue: Both the deprecated InvokeEJBServlet and other endpoints are affected in version 7.2026.1.RC1
• SSI issue: User-controlled SSI #exec directives are passed directly to Runtime.exec() without validation, sanitization, or restriction
• SSI issue: Affects processing of .shtml files on Payara Server 7.2026.1.RC1 and allows arbitrary operating system command execution
• No CVE identifiers were provided in either report