Payara · Payara Server Full · CVE-2026-12986
**Name of the Vulnerable Software and Affected Versions**
Payara Server Full versions 4.x
Payara Server Full versions 5.x
Payara Server Full versions 6.x
Payara Server Full versions 7.x
Payara Server Full versions 7.2026.x
Payara Server Full versions 6.2025.x
Payara Server Full versions 6.2024.x
**Description**
A Server-Side Request Forgery (SSRF) issue exists in the `DownloadServlet` of the Admin GUI within the `admingui:console-common` module. This flaw, combined with a lack of Cross-Site Request Forgery (CSRF) protection on the `DownloadServlet`, allows a remote attacker to trick an authenticated administrator into sending their REST session token `gfresttoken` to an external host. An attacker can then use this stolen token to gain full administrative access to the domain, potentially leading to arbitrary code execution through the deployment of a WAR file. The issue affects the `DownloadServlet` and the following `ContentSource` implementations: `LogViewerContentSource()`, `LogFilesContentSource()`, `LBConfigContentSource()`, and `ClientStubsContentSource()`.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.