PT-2026-41932 · Oracle · Glassfish

Camilo G + 2 · Published 2026-05-19 · Updated 2026-05-21 · CVE-2026-2586

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GlassFish (affected versions not specified)

Description An authenticated Remote Code Execution (RCE) issue exists in the Administration Console. A user with access to the panel can send crafted requests to execute arbitrary operating system commands with the privileges of the application service user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-917

CWE-94

Related Identifiers

CVE-2026-2586

Affected Products

Glassfish

References · 4

• 🔥 https://gitlab.eclipse.org/security/cve-assignment/-/issues/87 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2586 · Security Note
• https://twitter.com/CVEnew/status/2056870218203328620 · Twitter Post
• https://twitter.com/TuringCyberObs/status/2057477219279098114 · Twitter Post