PT-2026-20388 · Payara · Payara Server

Published 2026-02-18 · Updated 2026-04-09 · CVE-2025-14340

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P/AU:N/R:U/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions Payara Server versions prior to 4.1.2.191.54 Payara Server versions prior to 5.83.0 Payara Server versions prior to 6.34.0 Payara Server versions prior to 7.2026.1

Description A cross-site scripting issue exists in the REST Management Interface. This allows an attacker to potentially mislead an administrator into changing the admin password through a crafted URL payload.

Recommendations Update Payara Server to version 4.1.2.191.54 or later. Update Payara Server to version 5.83.0 or later. Update Payara Server to version 6.34.0 or later. Update Payara Server to version 7.2026.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14340

Affected Products

Payara Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-14340 · Security Note
• https://docs.payara.fish/enterprise/docs/Security/Security%20Fix%20List.html · Note
• https://twitter.com/pdnuclei_bot/status/2042256256648515933 · Twitter Post
• https://twitter.com/CVEnew/status/2024123159486571006 · Twitter Post