CVEvulnerability

CVE-2026-2586

9.1 CRITICAL Published 2026-05-19 Modified 2026-07-24 Official page ↗
Status
Modified
Published
2026-05-19
Last modified
2026-07-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-917, CWE-94

Description

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

Affected configurations

• eclipse glassfish (< 8.0.2)

Related

Weakness · CWE (2)

  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness
  • CWE-94 Improper Control of Generation of Code weakness

References