Remote Code Execution Vulnerability in GlassFish Administration Console
CVE-2026-2586

9.1CRITICAL

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Glassfish
Vendor
CVE Published:
19 May 2026

What is CVE-2026-2586?

An authenticated Remote Code Execution vulnerability exists in the Administration Console of GlassFish. This flaw allows authorized users to send specially crafted requests, potentially resulting in the execution of arbitrary commands on the operating system with the privileges of the application service user. This exposure could lead to unauthorized control over the server, highlighting the need for vigilance and secured access controls in deployment environments.

Affected Version(s)

Eclipse Glassfish 8.0.2

References

https://gitlab.eclipse.org/security/cve-assignment/-/issu...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Camilo G. AkA Dedalo (DeepSecurity PerĂș)
Gabriel A. Hinostroza Ayala (DeepSecurity PerĂș)
.