{"id":"EM-20261112-V28Z","url":"https://cyber.eventmonitor.net/incident/EM-20261112-V28Z/critical-genericadminauthenticator-vulnerability-cve-2026-90908/","type":"cve","title":"Critical GenericAdminAuthenticator Vulnerability (CVE-2026-90908)","subtitle":"CVE-2026-90908","subject":"CVE-2026-90908","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-12T09:32:51.000Z","firstSignal":"2026-11-12T09:16:40.297Z","lastSignal":"2026-11-12T09:32:51.000Z","updated":"2026-11-12T10:08:44.750Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T09:32:51.000Z","why":"second independent source: C29 CIRCL Vulnerability-Lookup"},{"status":"Developing","at":"2026-11-12T09:32:51.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-12T09:16:40.297Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-12T09:32:51.000Z","what":"Born: second source, C29 CIRCL Vulnerability-Lookup. Page EM-20261112-V28Z created."}],"stages":[{"name":"Disclosed","at":"2026-11-12T09:16:40.297Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-12T09:16:40.297Z","detail":"CVSS 9.3"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-12T09:16:40.297Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-90908 (CVSS 9.3)","text":"A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the MBean server and lead to remote code execution. Azul Payara Micro is affected only when its JMX connector is enabled.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90908"},{"at":"2026-11-12T09:32:51.000Z","source":"C29","sourceName":"CIRCL Vulnerability-Lookup","role":"Database","severity":2,"title":"GHSA-qcx2-v78c-8gq4 / CVE-2026-90908","text":"A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the…","url":"https://vulnerability.circl.lu/vuln/GHSA-qcx2-v78c-8gq4"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-12T09:16:40.297","score":9.3,"severity":"CRITICAL","desc":"A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Successful exploitation can grant administrative access to the…","product":"","seen":1794478124750},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}