CVE-2026-2586: Remote Code Execution Vulnerability in GlassFish Administration Console
Summary
CVE-2026-2586: GlassFish's Administration Console is Vulnerable to RCE. Affects org.glassfish.main.admingui:console-common versions < 8.0.2. Fixed in 8.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GlassFish is an open-source application server that provides a robust platform for developing and deploying Java applications. The Administration Console is a web-based interface that allows users to manage the server and its applications. This console is crucial for configuring server settings, deploying applications, and monitoring performance. However, a critical vulnerability has been identified that allows authenticated users to execute arbitrary operating system commands, posing a significant security risk.
Vulnerability Detail
An authenticated Remote Code Execution (RCE) vulnerability exists in GlassFish's Administration Console. This flaw allows a user with access to the panel to send specially crafted requests that can execute arbitrary commands on the operating system with the privileges of the application service user. The vulnerability stems from improper input validation, which can be exploited by attackers to gain unauthorized access and control over the server. The potential ramifications include data breaches, system compromise, and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
8.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Administration Console to trusted users only. Implement network-level controls to limit access to the console from untrusted networks. Additionally, consider disabling the console if it is not actively in use.
Conclusion
The identified vulnerability in GlassFish's Administration Console poses a significant risk to applications utilizing this server. It is crucial to update the affected packages to their patched versions to mitigate the risk of remote code execution. Implementing access restrictions and monitoring tools like Vulert can further enhance security.
See every vulnerability recorded for org.glassfish.main.admingui:console-common →
FAQ
CVE-2026-2586 is a critical vulnerability in GlassFish's Administration Console that allows authenticated users to execute arbitrary operating system commands.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your pom.xml without any signup.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete system compromise.
Update the affected packages in your Maven project by modifying the pom.xml file to include the patched versions as specified in the 'how_to_fix' section.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.glassfish.main.admingui:console-common.
