Authenticated GlassFish EL Injection RCE (CVE-2026-2586)

An Expression Language Injection vulnerability in the GlassFish Administration Console allows an authenticated user to inject malicious EL expressions into parameters processed by the administrative web interface. Successful exploitation may lead to remote command execution on the affected server.

The vulnerability was identified in the server virtual configuration editing flow, where user-controllable parameters are interpreted insecurely by the application.

This occurs because:

• The administrative interface processes user-controlled parameters within EL expressions.
• The input is not properly validated or neutralized before being interpreted by the backend.
• An authenticated user in the administrative console can abuse the vulnerable behavior to invoke Java classes and methods.
• In a successful exploitation scenario, an attacker with valid credentials could execute commands on the underlying operating system.

Affected Component

• Product: GlassFish / Payara Administration Console
• CVE: CVE-2026-2586
• Type: Expression Language Injection
• Impact: Authenticated Remote Code Execution
• Vector: Administrative web interface

Proof of Concept

The test was performed in a local and controlled environment.

CVE-2026-2586.py --url https://glassfish:4848/ --user <USERNAME> --password <PASSWORD> --lhost 127.0.0.1 --lport 4444 --insecure

Vulnerable URL:

https://glassfish:4848/web/configuration/virtualServerEdit.jsf?name=server&configName=server-config&alertType=success&alertSummary=PAYLOAD&alertDetail=&bare=true

Legal

AUTHORIZED USE ONLY. DeepSecurity Perú does not endorse unauthorized access and takes no responsibility for any misuse of the information provided.