Compliance Impact

The vulnerability allows an attacker to exfiltrate the administrator's REST session token and gain full administrative access to the Payara domain, potentially leading to arbitrary code execution. Such unauthorized access and data leakage could compromise the confidentiality and integrity of sensitive data managed by the system.

This type of security breach can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure administrative controls to prevent unauthorized access.

Therefore, organizations using affected Payara Server versions may face increased risk of non-compliance due to potential data breaches and insufficient access controls stemming from this vulnerability.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-12986 is a critical vulnerability in the Admin GUI of Payara Server versions 4.x through 7.2026.x on all platforms. It involves a Server-Side Request Forgery (SSRF) flaw in the DownloadServlet component that allows a remote attacker to exfiltrate the administrator's REST session token (gfresttoken) to an attacker-controlled host.

Because the DownloadServlet lacks Cross-Site Request Forgery (CSRF) protection, an unauthenticated attacker can trick a logged-in administrator into triggering this token leak. The attacker can then replay the stolen token to gain full administrative access to the Payara domain.

This full administrative access can lead to arbitrary code execution, for example, by deploying malicious WAR files. The vulnerability affects the DownloadServlet and related ContentSource implementations within the admingui:console-common module.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including a full unauthenticated takeover of the Payara admin domain.

An attacker can exfiltrate the administrator's REST session token and use it to gain full administrative privileges without authentication.

With full admin access, the attacker can execute arbitrary code, such as deploying malicious applications, potentially compromising the entire server and any applications running on it.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability CVE-2026-12986 in Payara Server, it is important to update to the latest version of the Payara Platform Community, specifically version 7.2026.6 or later, which addresses the CSRF and SSRF vulnerabilities in the Admin Console and REST Management Interface.

Useful 0 Not Useful 0