Eclipse GlassFish CVE-2026-2586

Exploitation requires valid administrative credentials to the Eclipse GlassFish Administration Console (CVSS PR:H) and network reachability to the console endpoint (default TCP 4848); no user interaction is needed (UI:N) and attack complexity is low (AC:L) once authenticated. Exploitation is meaningfully limited to deployments where the admin console is reachable by the attacker and where admin credentials are obtainable or already held - internet-exposed consoles with weak or default credentials are the realistic worst case, while consoles bound to localhost or a management network behind strong authentication materially reduce exposure. The resulting command execution runs with the privileges of the GlassFish service account, so deployments running the server as a dedicated low-privilege user constrain post-exploitation impact relative to those running as root or Administrator.

The CVSS 9.1 score is driven primarily by the scope change (S:C) and full Confidentiality/Integrity/Availability impact (C:H/I:H/A:H), reflecting that an admin-console compromise pivots to OS-level control of the host. However, the vector requires PR:H (high privileges) - the attacker must already hold administrative credentials to the GlassFish console, which substantially limits the realistic attacker population to insiders, attackers who have already harvested admin credentials, or environments where the console is exposed with default/weak credentials. No EPSS score, KEV listing, or public POC has been provided in the input data, so this currently reads as a credible post-authentication privilege-to-RCE escalation rather than a wormable internet-facing threat. Defenders running GlassFish with the admin console exposed to untrusted networks, or with shared/weak admin credentials, should treat this as high priority; isolated deployments with strong admin authentication face materially lower real-world risk than the raw 9.1 implies.

An attacker who has obtained valid GlassFish administrator credentials - through phishing, credential reuse, an exposed console with weak defaults, or a prior compromise - authenticates to the Administration Console and submits a crafted request that smuggles operating system commands into a code-evaluation path. The server executes the commands as the application service user, giving the attacker an interactive foothold from which to read application secrets, pivot into the internal network, or deploy a malicious WAR for persistence.