CVE-2026-12986

{
  "id": "CVE-2026-12986",
  "sourceIdentifier": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
  "published": "2026-06-24T15:16:39.737",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain.\n\nA Server-Side Request Forgery (SSRF) vulnerability in the DownloadServlet of the Admin GUI in Payara Server allows a remote attacker to exfiltrate the administrator's REST session token (gfresttoken) to an attacker-controlled host via a crafted request URL. Combined with the absence of CSRF protection on DownloadServlet, an unauthenticated attacker can trick a logged-in administrator into triggering the token leak, then replay the stolen token to gain full administrative access to the Payara domain, leading to arbitrary code execution via WAR deployment. The vulnerability exists in the DownloadServlet and associated ContentSource implementations (LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, ClientStubsContentSource) within the admingui:console-common module."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad crítica en la GUI de administración en Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x en todas las plataformas que permite al atacante filtrar el gfresttoken de administrador a un host controlado por el atacante, lo que puede resultar en una toma de control completa no autenticada del dominio de administración de Payara.\n\nUna vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en el DownloadServlet de la GUI de administración en Payara Server permite a un atacante remoto exfiltrar el token de sesión REST del administrador (gfresttoken) a un host controlado por el atacante a través de una URL de petición manipulada. Combinado con la ausencia de protección CSRF en DownloadServlet, un atacante no autenticado puede engañar a un administrador que ha iniciado sesión para que active la fuga del token, luego reproducir el token robado para obtener acceso administrativo completo al dominio de Payara, lo que lleva a la ejecución de código arbitrario a través del despliegue de WAR. La vulnerabilidad existe en el DownloadServlet y las implementaciones de ContentSource asociadas (LogViewerContentSource, LogFilesContentSource, LBConfigContentSource, ClientStubsContentSource) dentro del módulo admingui:console-common."
    }
  ],
  "affected": [
    {
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "affectedData": [
        {
          "vendor": "Payara",
          "product": "Payara Server",
          "defaultStatus": "affected",
          "packageName": "org.glassfish.main.admingui:console-common",
          "modules": [
            "Admin GUI"
          ],
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "repo": "https://github.com/payara/Payara/",
          "versions": [
            {
              "version": "7.2025.1",
              "lessThan": "7.2026.6",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.0.0",
              "lessThan": "7.1.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0.0",
              "lessThan": "6.39.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.20.0",
              "lessThan": "5.88.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.1.144",
              "lessThan": "4.1.2.191.56",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "5.181",
              "lessThanOrEqual": "5.201.2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "5.2020.1",
              "lessThanOrEqual": "5.2022.5",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "6.2023.1",
              "lessThanOrEqual": "6.2025.11",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Amber",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "PRESENT",
          "Automatable": "YES",
          "Recovery": "USER",
          "valueDensity": "CONCENTRATED",
          "vulnerabilityResponseEffort": "MODERATE",
          "providerUrgency": "AMBER"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-24T14:52:09.838012Z",
          "id": "CVE-2026-12986",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%207.2026.6.html",
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
    }
  ]
}