gabrielha12/glassfish-researchCVE-2026-2586 — Eclipse GlassFish EL injection to RCE
Vulnerability research on the Eclipse GlassFish administration console.
| CVE | Issue | Severity | Status |
|---|---|---|---|
| CVE-2026-2586 | EL injection → RCE | 9.1 Critical | Fixed in 8.0.2 |
| — | — | — | Pending disclosure |
Affected: < 8.0.2 · CWE-917 · Authenticated RCE
The alertSummary and alertDetail parameters exist to render a status
message after saving a configuration. Their values were passed back through
the server-side Expression Language engine before rendering, letting an
authenticated console user reach Java classes through Reflection and execute
OS commands as the GlassFish process.
