EUVD-2026-30939
GHSA-96v6-hq43-x9h4
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user.
AnalysisAI
Remote code execution in Eclipse GlassFish allows attackers with administrative access to the Administration Console to execute arbitrary operating system commands as the application service user. The flaw stems from improper input handling in admin panel requests (CWE-94), and while CVSS rates it 9.1 due to scope change and full CIA impact, exploitation requires high privileges (PR:H). …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all GlassFish deployments and immediately restrict admin console network access to trusted administrative personnel and networks only. Within 7 days: Conduct forensic audit of admin console access logs for the past 90 days to identify unauthorized access; implement IP whitelisting and multi-factor authentication for all administrative accounts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today