Vulnerability · Published Mar 5, 2026 · Assigned by eclipse
CVE-2026-24457
Critical 9.1
In plain English
A critical-severity path traversal in Eclipse GlassFish from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse OpenMQ | 0 – before 6.5.26.6.0 – before 6.9.0 |
| Eclipse Foundation | Eclipse GlassFish | 0 – before 7.0.267.1.0 – before 7.1.18.0.0 – before 8.0.2 |
Weakness: CWE-22, CWE-27 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H