CVE-2026-2586

Vulnerability

CVE-2026-2586 is an Expression Language (EL) injection vulnerability in the GlassFish Administration Console. An authenticated user with access to the console can send crafted requests that trigger arbitrary OS command execution. The exact affected versions have not been disclosed in the available references [1].

Exploitation

An attacker must have valid credentials to the GlassFish Administration Console. By sending specially crafted HTTP requests containing malicious EL expressions, the attacker can inject and execute arbitrary commands on the underlying operating system [1].

Impact

Successful exploitation allows the attacker to execute arbitrary operating system commands with the privileges of the GlassFish application service user. This can lead to full compromise of the application server, including data exfiltration, lateral movement, and further system compromise [1].

Mitigation

As of the publication date, no official fix or workaround has been disclosed in the available references. Users should monitor vendor advisories and apply patches as soon as they become available [1].