Eclipse GlassFish CVE-2026-12605

Exploitation requires an administrator who is concurrently authenticated into the Eclipse GlassFish Admin Console to be induced (via CSRF, per UI:R in the CVSS vector) to trigger a request against the DownloadServlet ContentSources feature, which then leaks the gfresttoken to an attacker-controlled host. The exact prerequisites are: (1) a running Eclipse GlassFish 8.0.x instance before 8.0.4, (2) a valid, unexpired administrative session/token active in the victim's browser, and (3) attacker ability to deliver malicious content the admin will interact with. Limiting factors: the attack fails without an authenticated admin victim and without successful social-engineering interaction, and the stolen token is only useful until it expires, bounding the compromise window.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) indicates a network-reachable, low-complexity attack requiring no attacker privileges but requiring user interaction (the administrator must visit or interact with attacker content), with a scope change and total confidentiality, integrity, and availability impact - consistent with full domain takeover following token theft. EPSS score is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is NOT in CISA KEV and no POC is referenced, so there is no evidence of active exploitation or public exploit code at this time; this is a high-severity issue driven by potential impact rather than confirmed in-the-wild activity. The UI:R requirement (an authenticated admin must be socially engineered into visiting a malicious page while logged into the Admin Console) is the primary limiting factor that reduces this from a mass-exploitable flaw to a targeted-attack scenario. No SSVC decision data was supplied. Overall this is a genuine high priority for organizations running the affected 8.0.x line, tempered by the interaction and authenticated-victim prerequisites.

An attacker crafts a malicious web page containing a CSRF payload targeting the GlassFish DownloadServlet ContentSources endpoint and lures a logged-in GlassFish administrator to visit it. The victim's authenticated session causes the admin gfresttoken to be forwarded to the attacker's server via the SSRF, after which the attacker replays the token against the management REST API to seize full control of the GlassFish domain. No public POC is referenced in the available data.