This Azul Payara release puts a Jakarta EE specification for AI agents into a certified runtime for the first time, while still shipping the security patches long-running deployments depend on.
What does the Jakarta Agentic AI preview actually give you?
Azul Payara Community 7.2026.8 integrates the Jakarta Agentic AI 1.0 API into the Payara 7 runtime. The specification is a standalone Jakarta EE release, currently at Milestone 1 (1.0.0-M1) and out for early feedback – so this is a preview and your chance to build against the API inside a Jakarta EE 11 runtime and shape it before it is final.
The idea is simple: an agent is just a CDI bean. You mark a class with @Agent, inject a LargeLanguageModel the way you inject any other bean, and describe the workflow with @Trigger, @Decision, @Action and @Outcome – start, decide, act, record. Because agents live in the CDI container, persistence, transactions and events work exactly as they already do in your application.
That means no separate agent runtime to operate and no framework lock-in. You write agents against a Jakarta specification; the same way you write REST endpoints against Jakarta RESTful Web Services.
What else changes in Community 7.2026.8?
MicroProfile support moves from 6.1 to 7.1, with MicroProfile OpenAPI at 4.1.1. Observability work comes with it: OpenTelemetry instrumentation annotations jump from 2.14.0 to 2.30.0, OpenTelemetry no longer initialises unless explicitly enabled, and MicroProfile Metrics and OpenTelemetry metrics are now recorded separately so the two systems stop interfering with each other. Access logs gain cleaner console formatting from Micro and regex URI filtering, and the OSGi shell returns with its GoGo commands.
Which lines get the security fixes?
GHSA-r7wm-3cxj-wff9 is addressed in Azul Payara 6.41.0, 5.90.0 and 4.1.2.191.58. The 5 and 4 lines also close CVE-2026-54512 and CVE-2026-54513, a Jackson PolymorphicTypeValidator bypass fixed on the 6 line in July; the 7 line was never affected.
Shipping a patch across the full supported lifecycle, not only the newest major release, is the point. Azul is a registered CVE Numbering Authority (CNA) under CISA and DHS oversight, and backports patches to every supported version on a published monthly schedule – so the line you run is not a reason to delay upgrading.
Where is gRPC support available now?
The largest Enterprise feature of this cycle lands on the 7, 6 and 5 lines, with the gRPC runtime at 1.83.1 everywhere – a jump from 1.56.1 on the 5 line. gRPC is the transport of choice for high-throughput service-to-service calls, including the inference and serving infrastructure AI backends depend on, and it is now available from the oldest supported Enterprise line to the newest.
Thinking about the move to Payara 7?
Server 7.3.0 is Jakarta EE 11 certified across Full Platform, Web Profile and Core Profile; Micro 7.3.0 implements the Web Profile and Core Profile APIs. For teams on the 5 or 6 line, the jakarta.* namespace is stable between EE 10 and EE 11, so existing Jakarta EE 10 applications deploy on Payara 7 by upgrading the runtime rather than rewriting the codebase. Migration assessments are available through your Azul account team.
Next steps
We recommend upgrading to the latest release for your line – and if you are on 6, 5 or 4, that upgrade carries a security patch for GHSA-r7wm-3cxj-wff9.
- Try the Jakarta Agentic AI preview in Azul Payara Community 7.2026.8, pull the API from Maven Central and read the draft specification – we covered the milestone itself in Jakarta Agentic AI hits its first milestone.
- File issues, contribute fixes or follow the Payara 7 roadmap on the Payara GitHub repository.
- Review the upgrade instructions in the Azul Payara documentation and the Payara Server upgrade guide.
- For commercial support or a Payara 7 migration assessment, contact the team or your Azul account team.
For full details on this release, including the per-line component upgrades, see What’s New in the August 2026 Azul Payara Release.
