Zurück zur CVE-Übersicht
CVE-2026-2586
CRITICAL(9.1)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Risk Signal Score23/100 — NIEDRIG
- CVSS 9.1 — Kritisch
EPSS-Score
1%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
9.1
Technische Schwere
Beschreibung
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
GitHub Advisories
GHSA-96v6-hq43-x9h4CRITICAL
GlassFish's Administration Console is Vulnerable to RCE
maven/org.glassfish.main.admingui:console-common→ 8.0.2
GitHub Advisory