High 7.3Published Feb 18, 2026

CVE-2025-14340Admin Account Takeover via malicious URL payload

Updated under an hour ago (Oct 28, 2026, 3:00 AM ET)

Does this affect you?

It affects Payara Platform Payara Server. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Payara Platform Payara Server

Exploited in the last 30 days

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

CVSS: 7.3 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P/AU:N/R:U/RE:M/U:Red
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Payara
NVD analysis: Deferred
Record last updated: Feb 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Payara Platform Payara Server payara_platform:payara_server (from the name)	4.1.153.1 builds before 4.1.2.191.53; from 5.20.0 through 5.82.0; from 6.0.0 through 6.33.0; from 7.2024.1.Alpha1 through 7.2025.2; from 6.2022.1 through 6.2025.11; from 5.2020.2 through 5.2022.5; from 5.181 through 5.201.2; 4.1.2.191.54 not affected; and 3 more ranges	CNA record

References

References

https://docs.payara.fish/enterprise/docs/Security/Security%20Fix%20List.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.