1. Home
  2. CVE Database
  3. CVE-2026-2586
CRITICAL · 9.1

CVE-2026-2586

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of a...

Vulnerability Description

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
EclipseGlassfish< 8.0.2

Related Weaknesses (CWE)

CWE-94CWE-917

References

FAQ

What is CVE-2026-2586?

CVE-2026-2586 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of a...

How severe is CVE-2026-2586?

CVE-2026-2586 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-2586?

Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Glassfish.