CVE-2026-2586criticalCWE-917CWE-94

CVE-2026-2586: critical vulnerability in Eclipse Glassfish

Published · Updated

Follow this CVE+ Monitor Eclipse Glassfish+ Monitor org.glassfish.main.admingui:console-common

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.1epss 0.8%
from disclosure to weapon13 days
Published on NVDMay 19
1st PoC+13d
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Eclipse Foundation · Eclipse Glassfish
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Eclipse Glassfish

In the same product, most dangerous first.

CVE-2026-2587CRITICALCVE-2026-2587EPSS 0.6%CVE-2024-9342MEDIUMCVE-2024-9342EPSS 0.5%CVE-2024-8646MEDIUMEclipse Glassfish: URL redirection vulnerability to untrusted sitesEPSS 0.4%CVE-2024-9408HIGHCVE-2024-9408EPSS 0.3%CVE-2024-9343MEDIUMCVE-2024-9343EPSS 0.3%CVE-2024-10032MEDIUMCVE-2024-10032EPSS 0.2%