CVE-2026-12986

Estado: AplazadaAlta (7.3)—

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain.

A Server-Side Request Forgery (SSRF) vulnerability in the DownloadServlet of the Admin GUI in Payara Server allows a remote attacker to exfiltrate the administrator's REST session token (gfresttoken) to an attacker-controlled host via a crafted request URL.

Leer descripción completaMostrar menos

Combined with the absence of CSRF protection on DownloadServlet, an unauthenticated attacker can trick a logged-in administrator into triggering the token leak, then replay the stolen token to gain full administrative access to the Payara domain, leading to arbitrary code execution via WAR deployment. The vulnerability exists in the DownloadServlet and associated ContentSource implementations (LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, ClientStubsContentSource) within the admingui:console-common module.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Amber
Puntuación base: 7.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.27%
Percentil entre todas las CVEs puntuadas: 18
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution60 %
Impacto principalT1185 Browser Session Hijackingcollection55 %
Impacto secundarioT1090 Proxycommand and control55 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Training User Account Management SSL/TLS Inspection Network Intrusion Prevention Filter Network Traffic Application Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Payara — Payara Server^AI

CWE

CWE-352, CWE-918

Referencias

https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%207.2026.6.html

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-12986",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-12986",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-24T14:52:09.838012Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
        "cvssData": {
          "Safety": "PRESENT",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 7.3,
          "Automatable": "YES",
          "attackVector": "ADJACENT",
          "baseSeverity": "HIGH",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Amber",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "AMBER",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "affectedData": [
        {
          "repo": "https://github.com/payara/Payara/",
          "vendor": "Payara",
          "modules": [
            "Admin GUI"
          ],
          "product": "Payara Server",
          "versions": [
            {
              "status": "affected",
              "version": "7.2025.1",
              "lessThan": "7.2026.6",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "lessThan": "7.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.39.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.20.0",
              "lessThan": "5.88.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.1.144",
              "lessThan": "4.1.2.191.56",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.181",
              "versionType": "custom",
              "lessThanOrEqual": "5.201.2"
            },
            {
              "status": "affected",
              "version": "5.2020.1",
              "versionType": "custom",
              "lessThanOrEqual": "5.2022.5"
            },
            {
              "status": "affected",
              "version": "6.2023.1",
              "versionType": "custom",
              "lessThanOrEqual": "6.2025.11"
            }
          ],
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "packageName": "org.glassfish.main.admingui:console-common",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-06-24T15:16:39.737",
  "references": [
    {
      "url": "https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%207.2026.6.html",
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain.\n\nA Server-Side Request Forgery (SSRF) vulnerability in the DownloadServlet of the Admin GUI in Payara Server allows a remote attacker to exfiltrate the administrator's REST session token (gfresttoken) to an attacker-controlled host via a crafted request URL. Combined with the absence of CSRF protection on DownloadServlet, an unauthenticated attacker can trick a logged-in administrator into triggering the token leak, then replay the stolen token to gain full administrative access to the Payara domain, leading to arbitrary code execution via WAR deployment. The vulnerability exists in the DownloadServlet and associated ContentSource implementations (LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, ClientStubsContentSource) within the admingui:console-common module."
    }
  ],
  "lastModified": "2026-06-25T20:11:34.393",
  "sourceIdentifier": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
}