CVE-2026-2586

Katalog CVE

CVSS 9.1 · Critical EPSS 0,83%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada eclipse glassfish. Skor CVSS 3.1 9.1 (Critical) menurut eclipse.org.

Deskripsi (NVD)

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

Rincian

Terbit di NVD

19 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber eclipse.org
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.eclipse.org/security/cve-assignment/-/issues/87 exploit · issue tracking · advisory pihak ketiga