GHSA-96v6-hq43-x9h4

ghsaUSosv

GlassFish's Administration Console is Vulnerable to RCE

view advisory published 2026-05-19Licence: CC-BY-4.0

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-2586US	—	0.84% (58th)	Exploit	2026-05-19
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allo…

references

External citations — patches, advisories, analysis.

https://github.com/eclipse-ee4j/glassfishPACKAGE
https://github.com/eclipse-ee4j/glassfish/releases/tag/8.0.2WEB
https://gitlab.eclipse.org/security/cve-assignment/-/issues/87WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-2586ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan