CVE-2026-2586 is a critical authenticated remote code execution vulnerability in Eclipse GlassFish's Administration Console. It allows an authenticated user to execute arbitrary OS commands via crafted requests, leveraging improper control of code generation (CWE-94). The vulnerability affects multiple versions: from 7.0.0 up to 7.0.25, version 7.1.0, and from 8.0.0 to 8.0.1. The issue is resolved in versions 7.0.26, 7.1.1, and 8.0.2. Versions 5.1.0 through 6.2.5 have an unknown impact status. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

Successful exploitation allows an authenticated user with access to the Administration Console to execute arbitrary operating system commands with the privileges of the GlassFish application service user. This can lead to full compromise of the affected system, including data theft, service disruption, or further lateral movement within the environment.

Fixed versions are available: upgrade to Eclipse GlassFish 7.0.26, 7.1.1, or 8.0.2 or later. Since no official remediation level or patch links are provided, users should consult the Eclipse Foundation's official advisories for the latest patches and guidance. Until patched, restrict access to the Administration Console to trusted administrators only and monitor for suspicious activity. Patch status is not yet confirmed in the provided data; verify with the vendor advisory for current remediation details.