Vulnerability · Published May 19, 2026 · Assigned by eclipse
CVE-2026-2586
Critical 9.1
In plain English
A critical-severity code injection in Eclipse Glassfish from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.glassfish.jsftemplating:jsftemplating | 4.2.0 | GHSA-96v6-hq43-x9h4 |
| Maven | org.glassfish.main.admingui:console-common | 8.0.2 | GHSA-96v6-hq43-x9h4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Glassfish | 7.0.0 – before 7.0.267.1.0 – before 7.1.18.0.0 – before 8.0.2 |
Weakness: CWE-94, CWE-917 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H