CVE-2026-2586 is an authenticated remote code execution vulnerability in Eclipse GlassFish's Administration Console. It arises from improper control of code generation (CWE-94) and improper restriction of operations within a critical resource (CWE-917). An attacker with authenticated access can craft requests to execute arbitrary OS commands with the privileges of the application service user. This vulnerability affects versions 7.1.0 and 8.0.0. The CVSS score of 9.1 reflects critical severity with network attack vector and high impact on confidentiality, integrity, and availability. No patch or official remediation has been published by the Eclipse Foundation as of the published date.

Successful exploitation allows an authenticated user to execute arbitrary operating system commands with the privileges of the application service user, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Administration Console to trusted users only and monitor for suspicious activity. Avoid exposing the console to untrusted networks. Follow the Eclipse Foundation's updates for any forthcoming patches or mitigations.