What’s New in the October 2026 Azul Payara Release?

Smart Summary

The October 2026 Azul Payara release patches three security issues across every supported branch, from Azul Payara 7.5.0 down to Payara 4, adds CDI DevMode to the 7 and 6 lines, and ports the SSH provider and Windows SSH support to the 7, 6, and 5 lines. Payara Community 7.2026.10 removes the need for elevated permissions on SSH nodes.

In this post you will learn:

• Which security fixes landed on which Azul Payara branches and why they reach back to Payara 4
• What CDI DevMode adds to Azul Payara Server 7.5.0 and 6.43.0
• What changes for SSH node management and administration commands
• What else changes on the 6, 5, and 4 lines, including the removal of DCOM
• What the community contributed to Payara Community 7.2026.10

If you run Azul Payara (request free trial here), this month’s main reason to upgrade is security. Three fixes ship across Azul Payara Server and Micro 7.5.0, 6.43.0, 5.92.0, and 4.1.2.191.60: a remote code execution vulnerability in Eclipse GlassFish, a remote code execution issue in JSFTemplating, and cross-site scripting in the Admin Console that allows full control.

The release notes flag no breaking changes this cycle, and by the end of this post you will know which items apply to the line you run.

Three Security Fixes Across Every Branch

CVE-2026-2587 and CVE-2026-2586, a remote code execution vulnerability in Eclipse GlassFish, remote code execution in JSFTemplating, and cross-site scripting in the Admin Console that allows full control are fixed on every supported Azul Payara branch. Azul is a registered CVE Numbering Authority under CISA and DHS oversight, and patches are backported to every supported version on a published monthly schedule. There is no reason to delay upgrading based on the major-version line you run.

What’s New in Payara Server and Micro 7.5.0

Azul Payara Server and Micro 7.5.0 is the fifth monthly release since Payara 7 reached general availability in May. Server 7.5.0 is Jakarta EE 11 certified across Full Platform, Web Profile, and Core Profile, on MicroProfile 7.1.

The headline feature is CDI DevMode, now implemented on the 7 and 6 lines. It adds a development-time console that shows how CDI beans, injection points, interceptors, and events are wired together in a running application, so wiring problems such as circular or unresolved dependencies are easier to find. It is for development only and is enabled with the payara.dev.console system property.

The SSH provider and Windows SSH support are also ported to Azul Payara 7, 6, and 5, alongside the new delete-jvm-option and delete-system-properties commands and a JNDI context that now throws a NameNotFoundException when a name cannot be found. Fixes include concurrent deployments failing because of a stateful singleton, applications that use the MicroProfile REST Client not deploying after a domain restart, and leak prevention for the JAX-RS client in WAR libraries. EclipseLink moves to 5.0.1 and Mojarra to 4.1.16.

The 6, 5, and 4 Lines

Azul Payara Server and Micro 6.43.0 continues the Jakarta EE 10 line on MicroProfile 7.1, with CDI DevMode, the SSH provider and Windows SSH support, and the new administration commands. Azul Payara Server and Micro 5.92.0 stays on Jakarta EE 8 and MicroProfile 4.1, with the SSH provider and Windows SSH support and the administration commands. DCOM is removed from both the 6 and 5 lines. Azul Payara Server and Micro 4.1.2.191.60 receives the three security fixes and the concurrent deployment fix.

Payara Community 7.2026.10 (download here) tracks the Payara 7 development line, and this month is about making Payara easier to run: SSH nodes no longer require elevated permissions, and delete-jvm-option and delete-system-properties make configuration easier to manage from the command line. Three changes came from community contributors: lprimak fixed REST Client deployment after a domain restart and added JAX-RS client leak prevention, and mkarg made the JNDI context throw a NameNotFoundException. Thank you both.

We recommend upgrading to the latest release for your line, and strongly so given the security fixes. The full breakdown of the release can be found on Foojay.

Frequently Asked Questions

What security issues are fixed in the October 2026 Azul Payara release?

Three security items are fixed: CVE-2026-2587 and CVE-2026-2586, a remote code execution vulnerability in Eclipse GlassFish, remote code execution in JSFTemplating, and cross-site scripting in the Admin Console that allows full control. The fixes ship in Azul Payara Server and Micro 7.5.0, 6.43.0, 5.92.0, and 4.1.2.191.60.

Which Jakarta EE version does each Payara release line support?

Azul Payara Server & Micro 7 support Jakarta EE 11, with Azul Payara Server 7 certified across the Full Platform, Web Profile, and Core Profile. Azul Payara Server and Micro 6 support Jakarta EE 10, and Azul Payara Server and Micro 5 support Jakarta EE 8 on the javax.* namespace. All of them, along with Payara 4, currently receive monthly security and bug-fix releases.

Can Jakarta EE 10 applications run on a Jakarta EE 11 application server?

Yes. The jakarta.* namespace is stable between Jakarta EE 10 and Jakarta EE 11, so an application built for Jakarta EE 10 deploys on a Jakarta EE 11 runtime without namespace changes. Moving from Azul Payara Server 6 to Azul Payara Server 7 is a runtime upgrade rather than a code rewrite for most applications. Migration assessments are available from Azul for teams planning the move.

How long do application server vendors support older major versions?

Practice varies widely, and many vendors treat upgrading to the current major version as the remedy for a security issue. Azul backports security patches across every supported Azul Payara branch on a published monthly schedule, currently spanning Azul Payara Server and Micro 7, 6, 5, and 4.

What is CDI DevMode in Azul Payara?

CDI DevMode is a development-time console for inspecting and diagnosing CDI applications. It shows the beans, scopes, interceptors, decorators, observers, and events the container discovers, builds a dependency graph that flags circular dependencies, and highlights unresolved or ambiguous injection points. It is implemented in Azul Payara Server and Micro 7.5.0 and 6.43.0, is intended for development and debugging only, and is enabled with the payara.dev.console system property.