Remote Code Execution Vulnerability in GlassFish Administration Console
CVE-2026-2586

9.1CRITICAL

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Glassfish
Vendor
CVE Published:
19 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-2586?

An authenticated Remote Code Execution vulnerability exists in the Administration Console of GlassFish. This flaw allows authorized users to send specially crafted requests, potentially resulting in the execution of arbitrary commands on the operating system with the privileges of the application service user. This exposure could lead to unauthorized control over the server, highlighting the need for vigilance and secured access controls in deployment environments.

Affected Version(s)

Eclipse Glassfish 7.0.0 < 7.0.26

Eclipse Glassfish 7.1.0 < 7.1.1

Eclipse Glassfish 8.0.0 < 8.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Glassfish-research
Created by GabrielHA12

References

https://gitlab.eclipse.org/security/cve-assignment/-/issu...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Camilo G. AkA Dedalo (DeepSecurity Perú)
Gabriel A. Hinostroza Ayala (DeepSecurity Perú)
.