CVE-2026-2586: Eclipse Glassfish RCE Vulnerability

CVE-2026-2586 Overview

CVE-2026-2586 is an authenticated Remote Code Execution (RCE) vulnerability in the Eclipse GlassFish Administration Console. An attacker with administrative panel access can send crafted requests that execute arbitrary operating system commands. The commands run with the privileges of the application service user, which often translates to elevated access on the host. The flaw is tracked under CWE-94: Improper Control of Generation of Code. Eclipse assigned the CVE through its security tracker and published technical details in the Eclipse CVE Assignment Issue.

Critical Impact

A privileged user can execute arbitrary OS commands on the GlassFish host, leading to full server compromise, lateral movement, and data exfiltration.

Affected Products

• Eclipse GlassFish (see vendor advisory for affected versions)
• Eclipse GlassFish Administration Console component
• Deployments exposing the GlassFish admin panel to authenticated users

Discovery Timeline

• 2026-05-19 - CVE-2026-2586 published to the National Vulnerability Database (NVD)
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-2586

Vulnerability Analysis

The vulnerability resides in the Eclipse GlassFish Administration Console, the web-based management interface used to configure and operate the GlassFish application server. The console accepts crafted requests from authenticated users and passes attacker-controlled input into a code or command execution path without sufficient validation. The result is arbitrary operating system command execution under the GlassFish service account.

Because the issue requires authentication to the admin panel, exploitation depends on prior credential compromise, weak admin passwords, or insider access. Once an attacker reaches the console, the path to code execution is direct. The classification under [CWE-94] indicates improper control of code generation, meaning attacker input influences code or commands that GlassFish subsequently executes.

The scope-changed impact reflects that code running as the GlassFish service user can affect resources beyond the application's security boundary, including hosted applications, configuration secrets, and adjacent systems.

Root Cause

The root cause is insufficient sanitization of administrative input in the Administration Console. Crafted parameters reach a command or code execution sink without escaping or allowlisting. The console trusts authenticated input and forwards it to underlying system calls or interpreted logic.

Attack Vector

The attack vector is network-based. An authenticated user submits a crafted HTTP request to the Administration Console. The request carries payloads that the server interprets as operating system commands. The commands execute with the privileges of the GlassFish service user. No user interaction is required beyond the attacker's own authenticated session.

No public proof-of-concept code has been verified at the time of writing. The vulnerability mechanism is documented in the Eclipse CVE Assignment Issue.

Detection Methods for CVE-2026-2586

Indicators of Compromise

• Unexpected child processes spawned by the GlassFish Java process, such as sh, bash, cmd.exe, or powershell.exe
• Outbound network connections initiated by the GlassFish service user to unknown hosts
• New or modified files in GlassFish domains/<domain>/applications/ or config/ directories outside normal deployment windows
• Anomalous Administration Console access patterns from unusual source IPs or at off-hours

Detection Strategies

• Monitor process lineage on GlassFish hosts and alert when the application server spawns shell interpreters or system utilities
• Audit Administration Console access logs for requests containing suspicious parameters, encoded payloads, or command separators
• Correlate authenticated admin sessions with subsequent host-level command execution events
• Apply behavioral analytics to flag deviations from baseline GlassFish process activity

Monitoring Recommendations

• Forward GlassFish server.log and admin access logs to a centralized log platform for retention and correlation
• Enable host-based telemetry that captures process creation, command-line arguments, and parent-child relationships
• Track authentication events to the Administration Console and alert on failed login bursts followed by successful logins
• Review privileged account usage on the GlassFish service account, including interactive shell access

How to Mitigate CVE-2026-2586

Immediate Actions Required

• Restrict network access to the GlassFish Administration Console using firewall rules, allowing only trusted management networks
• Rotate all GlassFish administrative credentials and enforce strong, unique passwords
• Audit existing admin accounts and remove any that are not actively required
• Run the GlassFish service under a least-privilege account that cannot escalate to root or Administrator

Patch Information

Consult the Eclipse CVE Assignment Issue for the current patch status and fixed versions. Apply the vendor-supplied update for Eclipse GlassFish as soon as it is available for your release branch. Validate the patch in a non-production environment before deploying to production hosts.

Workarounds

• Bind the Administration Console listener to localhost only and access it through an SSH tunnel or bastion host
• Place the admin interface behind a reverse proxy that enforces mutual TLS or additional authentication
• Disable the Administration Console on production nodes where remote management is not required
• Apply network segmentation so that GlassFish hosts cannot initiate arbitrary outbound connections

# Configuration example: restrict admin listener to localhost
asadmin set configs.config.server-config.network-config.network-listeners.network-listener.admin-listener.address=127.0.0.1
asadmin restart-domain