The August 2026 Payara release ships five simultaneous version lines. The headline is Azul Payara Community 7.2026.8, which previews the Jakarta Agentic AI 1.0.0-M1 specification (a vendor-neutral CDI-based API for building AI agents on Jakarta EE runtimes) and upgrades MicroProfile from 6.1 to 7.1. Enterprise lines 7, 6, and 5 gain gRPC support (runtime 1.83.1). A security advisory, GHSA-r7wm-3cxj-wff9, is patched across the 6, 5, and 4 lines, with two additional Jackson CVEs (CVE-2026-54512, CVE-2026-54513) closed on the 5 and 4 lines; the 7 line was never affected. Server and Micro 7.3.0 is the third monthly release on the Payara 7 line since its May GA, certified for Jakarta EE 11. Lines 6.41.0, 5.90.0, and 4.1.2.191.58 receive shared bug fixes, component upgrades, and Docker image refreshes appropriate to their supported JDK versions.
Table of contents
Downloads & Release NotesThe Spotlight: A First Preview of Jakarta Agentic AIAzul Payara Community 7.2026.8 : MicroProfile 7.1A Security Advisory Patched Across the 6, 5 & 4 LinesgRPC Support Arrives Across the Enterprise LinesAzul Payara Server and Micro 7.3.0: The Payara 7 Line, Monthly CadenceAzul Payara Server and Micro 6.41.0: Jakarta EE 10, ContinuedAzul Payara Server and Micro 5.90.0: Jakarta EE 8, ContinuedAzul Payara Server and Micro 4.1.2.191.58: Legacy Branch, Still MaintainedLooking AheadQuestions this post answers
What CVEs does the Payara 5.90.0 and 4.1.2.191.58 security patch fix?
Payara 5.90.0 and 4.1.2.191.58 close GHSA-r7wm-3cxj-wff9 along with two Jackson vulnerabilities, CVE-2026-54512 and CVE-2026-54513, both related to a Jackson PolymorphicTypeValidator bypass. This same GHSA advisory was already patched on the Payara 6 line in July, and the Payara 7 line was never affected by it. daily.dev helps java teams track CVE patches like these across supported Payara release lines.
What is the Jakarta Agentic AI specification and how do I use it in Payara?
Jakarta Agentic AI is a vendor-neutral specification for building AI agents on Jakarta EE runtimes, first previewed as milestone 1.0.0-M1 in Azul Payara Community 7.2026.8. An agent is a CDI bean annotated with @Agent, with a LargeLanguageModel injected like any other bean, @Trigger starting workflows from CDI events, and @Decision, @Action, and @Outcome modeling workflow steps, so it runs inside the existing CDI container without a separate agent runtime. developers evaluating agentic AI frameworks can follow specification previews like this one on daily.dev.
Does gRPC support work the same way across Payara 5, 6, and 7?
Yes, Payara 7, 6, and 5 all ship the gRPC runtime at version 1.83.1 in the August 2026 release, giving gRPC support across every currently maintained Enterprise line. For the 5 line this is an upgrade from gRPC 1.56.1. gRPC is positioned as the transport for high-throughput service-to-service calls, including AI inference and serving infrastructure. teams standardizing on gRPC across mixed-version Java servers can track runtime bumps like this via daily.dev.