Vulnerability details
CVE-2026-2586
Eclipse Foundation Eclipse Glassfish
CVSS 3.1
9.1Critical
Official description
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 3.1 | CVEProject cvelistV5 (CNA) (eclipse) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Eclipse Foundation | Eclipse Glassfish | 5.1.0 ≤ v ≤ 6.2.5 | CVEProject cvelistV5 (CNA) |
| Eclipse Foundation | Eclipse Glassfish | 7.0.0 ≤ v < 7.0.26 | CVEProject cvelistV5 (CNA) |
| Eclipse Foundation | Eclipse Glassfish | 7.1.0 ≤ v < 7.1.1 | CVEProject cvelistV5 (CNA) |
| Eclipse Foundation | Eclipse Glassfish | 8.0.0 ≤ v < 8.0.2 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-19
- Last updated
- 2026-06-29
- State
- Published
- Assigner (CNA)
- eclipse
Exploit prediction (EPSS)
0.84%
Probability of exploitation in 30 days
58.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')
- CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')