Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server

<p>Posted by Ron E on Sep 03</p>Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms<br /> that rely on attacker-controlled reflection, dynamic class loading, and<br /> unsafe deserialization. These endpoints allow remote clients to perform<br /> arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke<br /> EJB business methods via reflection without sufficien