CVE-2026-2586

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://gitlab.eclipse.org/security/cve-assignment/-/issues/87	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-19 15:16

Updated : 2026-07-24 12:10

NVD link : CVE-2026-2586

Mitre link : CVE-2026-2586

CVE.ORG link : CVE-2026-2586

JSON object : View

Products Affected

eclipse

glassfish

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

{"id": "CVE-2026-2586", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2586", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"repo": "https://github.com/eclipse-ee4j/glassfish", "vendor": "Eclipse Foundation", "product": "Eclipse Glassfish", "versions": [{"status": "unknown", "version": "5.1.0", "versionType": "semver", "lessThanOrEqual": "6.2.5"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.26", "versionType": "semver"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.1", "versionType": "semver"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-19T15:16:28.413", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/87", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "emo@eclipse.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-917"}]}], "descriptions": [{"lang": "en", "value": "An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown."}, {"lang": "es", "value": "Una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) autenticada fue identificada en la Consola de Administraci\u00f3n de GlassFish. Un usuario con acceso al panel puede enviar solicitudes manipuladas que permiten la ejecuci\u00f3n de comandos arbitrarios del sistema operativo con los privilegios del usuario del servicio de la aplicaci\u00f3n."}], "lastModified": "2026-07-24T12:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "589D2C3E-E047-4F09-B0CC-878611D553DB", "versionEndExcluding": "8.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}