PT-2026-46854 · Maven · Org.Glassfish.Jsftemplating:Jsftemplating+1

Published 2026-05-19 · Updated 2026-05-19

OSV

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

GHSA-96V6-HQ43-X9H4

Affected Products

Org.Glassfish.Jsftemplating:Jsftemplating

Org.Glassfish.Main.Admingui:Console-Common

References · 5

• https://osv.dev/vulnerability/GHSA-96v6-hq43-x9h4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2586 · Security Note
• https://github.com/eclipse-ee4j/glassfish · Note
• https://github.com/eclipse-ee4j/glassfish/releases/tag/8.0.2 · Note
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/87 · Note