What is CVE-2026-2586?

CVE-2026-2586 is a critical-severity vulnerability in Eclipse Glassfish, classified under Code Injection. CVSS score: 9.1/10. Published 2026-05-19.

How severe is CVE-2026-2586?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Is CVE-2026-2586 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Eclipse Glassfish

CVE-2026-2586

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.008 (55.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Eclipse Glassfish
Eclipse Foundation Glassfish — versions 7.1.0, 8.0.2, 8.0.0

Weakness classification (CWE)

Public proof-of-concept exploits

References

emo@eclipse.org (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2026-2586?: CVE-2026-2586 is a critical-severity vulnerability in Eclipse Glassfish, classified under Code Injection. CVSS score: 9.1/10. Published 2026-05-19.
How severe is CVE-2026-2586?: Critical severity. CVSS v3 base score is 9.1 out of 10.
Is CVE-2026-2586 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.