CVE-2026-2586

9.1 Critique

Publiée le 19/05/2026 à 17:16 · Modifiée le 24/07/2026 à 14:10 · Modifiée · Source : emo@eclipse.org

Description

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

Traduire en français

Produits concernés

Eclipse Foundation Eclipse Glassfish
Eclipse glassfish

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	emo@eclipse.org	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94
CWE-917

Références

https://gitlab.eclipse.org/security/cve-assignment/-/issues/87 ExploitIssue TrackingThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories