PT-2026-41932 · Oracle · Glassfish

Camilo G + 2 · CVE-2026-2586 · Published 2026-05-19 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GlassFish (affected versions not specified)

Description An authenticated Remote Code Execution (RCE) issue exists in the Administration Console. A user with access to the panel can send crafted requests to execute arbitrary operating system commands with the privileges of the application service user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-917

Related Identifiers

CVE-2026-2586

GHSA-96V6-HQ43-X9H4

Affected Products

Glassfish

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2586.json · Exploit
• 🔥 https://gitlab.eclipse.org/security/cve-assignment/-/issues/87 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2586 · Security Note
• https://osv.dev/vulnerability/GHSA-96v6-hq43-x9h4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2586 · Vendor Advisory
• https://github.com/eclipse-ee4j/glassfish · Note
• https://github.com/eclipse-ee4j/glassfish/releases/tag/8.0.2 · Note
• https://twitter.com/TuringCyberObs/status/2057477219279098114 · Twitter Post
• https://t.me/cveNotify/178371 · Telegram Post
• https://t.me/cveNotify/220111 · Telegram Post
• https://twitter.com/CVEnew/status/2056870218203328620 · Twitter Post