CVE-2026-2586: Eclipse GlassFish RCE via EL Injection in Administration Console

CVE-2026-2586 · Severity: critical · CVSS 9.1 · Published 2026-05-19

Eclipse GlassFish is an application server used to deploy and manage enterprise Java applications. A security vulnerability in its web-based administration console allows an authorized administrator to execute malicious commands on the underlying server. This could lead to a complete takeover of the server, unauthorized access to sensitive data, or disruption of hosted services.

Technologies: Eclipse Foundation GlassFish, org.glassfish.main.admingui:console-common (Maven). Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-2586 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2586 being exploited in the wild.
How severe is CVE-2026-2586?
Critical severity, with a CVSS score of 9.1, published 19 May 2026.
Which products and versions are affected?
Eclipse Foundation GlassFish < 8.0.2, 7.1.0, 8.0.0; Eclipse Foundation Jsftemplating < 4.2.0; org.glassfish.jsftemplating:jsftemplating (Maven) < 4.2.0, ECOSYSTEM:introduced=0,fixed=4.2.0; org.glassfish.main.admingui:console-common (Maven) < 8.0.2, ECOSYSTEM:introduced=0,fixed=8.0.2.
Is there a fix for CVE-2026-2586?
Yes. org.glassfish.jsftemplating:jsftemplating (Maven): upgrade to 4.2.0 or later; org.glassfish.main.admingui:console-common (Maven): upgrade to 8.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2586 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-2586?
Check whether you run Eclipse Foundation GlassFish, Eclipse Foundation Jsftemplating, org.glassfish.jsftemplating:jsftemplating (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.glassfish.jsftemplating:jsftemplating (Maven): upgrade to 4.2.0 or later
    # set org.glassfish.jsftemplating:jsftemplating to 4.2.0 in your pom.xml or build.gradle
  • org.glassfish.main.admingui:console-common (Maven): upgrade to 8.0.2 or later
    # set org.glassfish.main.admingui:console-common to 8.0.2 in your pom.xml or build.gradle

Technical details

An authenticated Remote Code Execution (RCE) vulnerability exists in the GlassFish Administration Console due to an Expression Language (EL) injection flaw (CWE-917/CWE-94). The vulnerability is rooted in the 'jsftemplating' component and the 'console-common' module, where externally-influenced input is incorrectly neutralized before being processed as code. An attacker with high privileges (administrative access to the console) can send crafted network requests to execute arbitrary OS commands with the permissions of the GlassFish service user. The issue is resolved in GlassFish version 8.0.2 and jsftemplating version 4.2.0.

Affected products

  • Eclipse Foundation GlassFish < 8.0.2
  • GlassFish jsftemplating < 4.2.0

Identifiers

  • CVE-2026-2586
  • GHSA-96v6-hq43-x9h4

Timeline

  • 2025-12-09: disclosed: Vulnerability reported to Eclipse Foundation
  • 2026-05-05: patched: GlassFish 8.0.2 released with fixes
  • 2026-05-19: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.