Paper/Archive/CVE-2026-2586

CVE-2026-2586

Eclipse Foundation Eclipse Glassfish — An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console.

EPSS 0.8%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 57.9.579 × 2011.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

Affected

ProductAffectedFixed inSource

Eclipse Glassfish7.0.0 – < 7.0.267.0.26CNA

Eclipse Glassfish7.1.0 – < 7.1.17.1.1CNA

Eclipse Glassfish8.0.0 – < 8.0.28.0.2CNA

Scores by source

eclipse (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgitlab.eclipse.org/security/cve-assignment/-/issues/87