CVE-2026-2586 GlassFish's Administration Console is Vulnerable to RCE
Authenticated attackers can execute arbitrary OS commands via crafted requests in the GlassFish Administration Console.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2586?
CVE-2026-2586 is a critical command injection vulnerability in Eclipse Glassfish, published on 19 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
Which versions are affected by CVE-2026-2586?
4 open source packages ship an affected version, including org.glassfish.jsftemplating:jsftemplating and org.glassfish.main.admingui:console-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.glassfish.jsftemplating:jsftemplating Maven | All versions | 4.2.0 |
org.glassfish.jsftemplating:jsftemplating Maven | All versions | 4.2.0 |
org.glassfish.main.admingui:console-common Maven | All versions | 8.0.2 |
org.glassfish.main.admingui:console-common Maven | All versions | 8.0.2 |
Products include Eclipse Glassfish.
How do I fix CVE-2026-2586?
Upgrade org.glassfish.jsftemplating:jsftemplating to 4.2.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-2586 being exploited?
There is no known exploitation of CVE-2026-2586 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Eclipse Glassfish
- CVE-2026-12605 Server-side request forgery in Eclipse GlassFish
- CVE-2026-2587 GlassFish's gadget handler is vulnerable to RCE
- CVE-2024-9408 Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints
- CVE-2024-9329 Glassfish redirect to untrusted site
- CVE-2023-5763 Glassfish remote code execution
Sources
Also known as GHSA-96v6-hq43-x9h4.