Is CVE-2026-12986 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12986 being exploited in the wild.

How severe is CVE-2026-12986?

High severity, with a CVSS score of 4, published 24 June 2026.

Which products and versions are affected?

fish.payara.distributions:payara (Maven) >= 4.0.0, < 7.2026.6, ECOSYSTEM:introduced=4.0.0,fixed=7.2026.6; Payara Services Payara Server 4.x, 5.x, 6.x, 7.x (prior to 7.2026.6).

Is there a fix for CVE-2026-12986?

Yes. fish.payara.distributions:payara (Maven): upgrade to 7.2026.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12986 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-12986?

Check whether you run fish.payara.distributions:payara (Maven) or Payara Services Payara Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12986: Payara Server SSRF and CSRF in Admin GUI DownloadServlet

Q: Is there a fix for CVE-2026-12986?

Yes. fish.payara.distributions:payara (Maven): upgrade to 7.2026.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-12986 attacked?

It is attacked from the adjacent network, in a network appliance.

Q: Am I affected by CVE-2026-12986?

Check whether you run fish.payara.distributions:payara (Maven) or Payara Services Payara Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12986 · Severity: high · CVSS 4 · Published 2026-06-24

A security vulnerability exists in the Payara Server administration console, a tool used to manage enterprise Java applications. An attacker can trick a logged-in administrator into visiting a malicious link, which causes the server to leak the administrator's secret session token. Using this stolen token, the attacker can take full control of the server, potentially allowing them to steal data or run unauthorized software on the corporate network.

Technologies: Payara Services Payara Server. Vendors: Maven, Payara Services.

Quick answers

Is CVE-2026-12986 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12986 being exploited in the wild.
How severe is CVE-2026-12986?: High severity, with a CVSS score of 4, published 24 June 2026.
Which products and versions are affected?: fish.payara.distributions:payara (Maven) >= 4.0.0, < 7.2026.6, ECOSYSTEM:introduced=4.0.0,fixed=7.2026.6; Payara Services Payara Server 4.x, 5.x, 6.x, 7.x (prior to 7.2026.6).
Is there a fix for CVE-2026-12986?: Yes. fish.payara.distributions:payara (Maven): upgrade to 7.2026.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12986 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-12986?: Check whether you run fish.payara.distributions:payara (Maven) or Payara Services Payara Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fish.payara.distributions:payara (Maven): upgrade to 7.2026.6 or later

# set fish.payara.distributions:payara to 7.2026.6 in your pom.xml or build.gradle

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the DownloadServlet component of the Payara Server Admin GUI, specifically within the admingui:console-common module. Due to a lack of CSRF protection on this servlet, an unauthenticated attacker can use social engineering to trick an authenticated administrator into making a crafted request. This request causes the server to exfiltrate the administrator's REST session token (gfresttoken) to an attacker-controlled host. The attacker can then replay this token to gain full administrative access, which facilitates arbitrary code execution via malicious WAR file deployment. The issue affects multiple ContentSource implementations including LogViewer, LogFiles, LBConfig, and ClientStubs.

Affected products

Payara Payara Server 4.x, 5.x, 6.x, 7.x (prior to 7.2026.6)

Identifiers

CVE-2026-12986
GHSA-x939-7fq5-v9v6

Timeline

2026-06-24: disclosed
2026-06-24: advisory: NVD publication date

References

https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%207.2026.6.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.