CVE-2026-2586CWE-917CWE-94

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console

Critical · published May 19, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00825 · 57.0th percentile
Weaknesses
CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-19T14:12Z
EPSS history
Timeline
  • 19 MAY 14:12Z
    An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console
    cvelistv5