A Server‑Side Request Forgery flaw in the DownloadServlet of Payara Server’s Admin GUI can cause the system to send a victim’s administrator session token (gfresttoken) to an attacker‑controlled host. Because the servlet lacks CSRF protection, an attacker who tricks a logged‑in administrator into calling the URL can extract that token. The attacker can then replay the stolen token to the domain controller, gaining full administrative rights and the ability to deploy arbitrary WAR files for arbitrary code execution. This vulnerability is a classic Server‑Side Request Forgery (CWE‑918) combined with missing cross‑site request forgery safeguards (CWE‑352).

The flaw is present in Payara Server Full editions 4.x, 5.x, 6.x, 7.x and the platform‑specific releases 7.2026.x, 6.2025.x, 6.2024.x on all supported operating systems. Any instance that exposes the Admin GUI is potentially vulnerable.

The CVSS score of 7.3 indicates a moderate to high severity. The EPSS score is not available, but the flaw can be exploited by any unauthenticated user given that they can influence a logged‑in administrator to hit the vulnerable endpoint, a low‑effort social‑engineering attack. Because the vulnerability is not in the CISA KEV catalog, there is no current evidence of widespread exploitation, yet the potential for full domain takeover warrants immediate attention. An attacker could use the stolen token to execute arbitrary Java class deployment, leading to remote code execution.