CVE-2026-12986

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain. A...

CVE-2026-12986

Technical details are not publicly available in the provided documents. Monitor for updates.

org.glassfish.main.admingui:console-cluster-plugin (7.0.14), org.glassfish.main.admingui:console-common-full-plugin (7.0.14) +10 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.14)

org.glassfish.main.admingui:console-common MAVEN version 7.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.14 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.24), org.glassfish.main.admingui:console-commandrecorder-plugin (7.0.24) +11 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.24)

org.glassfish.main.admingui:console-common MAVEN version 7.0.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.24 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.10), org.glassfish.main.admingui:console-common-full-plugin (7.0.10) +10 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.10)

org.glassfish.main.admingui:console-common MAVEN version 7.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.10 -...

org.glassfish.main.admingui:console-cluster-plugin (6.0.0), org.glassfish.main.admingui:console-common-full-plugin (6.0.0) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.0.0)

org.glassfish.main.admingui:console-common MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.0.0 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.17), org.glassfish.main.admingui:console-commandrecorder-plugin (7.0.17) +11 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.17)

org.glassfish.main.admingui:console-common MAVEN version 7.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.17 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.5), org.glassfish.main.admingui:console-common-full-plugin (7.0.5) +10 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.5)

org.glassfish.main.admingui:console-common MAVEN version 7.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.5 -...

org.glassfish.main.admingui:console-cluster-plugin (4.0-b72), org.glassfish.main.admingui:console-common-full-plugin (4.0-b72) +8 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (4.0-b72)

org.glassfish.main.admingui:console-common MAVEN version 4.0-b72 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 4.0-b72 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.21), org.glassfish.main.admingui:console-commandrecorder-plugin (7.0.21) +11 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.21)

org.glassfish.main.admingui:console-common MAVEN version 7.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.21 -...

org.glassfish.main.admingui:console-cluster-plugin (3.1.2.2), org.glassfish.main.admingui:console-common-full-plugin (3.1.2.2) +6 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (3.1.2.2)

org.glassfish.main.admingui:console-common MAVEN version 3.1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 3.1.2.2 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.22), org.glassfish.main.admingui:console-commandrecorder-plugin (7.0.22) +11 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.22)

org.glassfish.main.admingui:console-common MAVEN version 7.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.22 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.6), org.glassfish.main.admingui:console-common-full-plugin (7.0.6) +10 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.6)

org.glassfish.main.admingui:console-common MAVEN version 7.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.6 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.3), org.glassfish.main.admingui:console-common-full-plugin (7.0.3) +10 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.3)

org.glassfish.main.admingui:console-common MAVEN version 7.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.3 -...

org.glassfish.main.admingui:console-cluster-plugin (6.2.1), org.glassfish.main.admingui:console-common-full-plugin (6.2.1) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.2.1)

org.glassfish.main.admingui:console-common MAVEN version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.2.1 -...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via specific endpoints. An attacker can make the system initiate arbitrary network requests to internal or external resources by sending crafted requests to these endpoints. Remediation There is no fixed...

org.glassfish.main.admingui:console-cluster-plugin (>=3.1.2, <=9.0.0-m3), org.glassfish.main.admingui:console-commandrecorder-plugin (>=7.0.16, <=9.0.0-m3) +16 more potentially affected by CVE-2024-9408 via org.glassfish.main.admingui:console-common (>=3.1.2, <=9.0.0-m3)

org.glassfish.main.admingui:console-common MAVEN version =3.1.2, =3.1.2, =7.0.16, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =4.0-b72, =7.1.1, =3.1.2, =4.0-b72, =3.1.2, =4.0-b90, =4.0-b90, =6.2.5, =9.0.0-m3 and more Source cves: CVE-2024-9408 Source advisory:...

org.glassfish.main.admingui:console-cluster-plugin (5.0.1), org.glassfish.main.admingui:console-common-full-plugin (5.0.1) +9 more potentially affected by CVE-2024-9408 via org.glassfish.main.admingui:console-common (5.0.1)

org.glassfish.main.admingui:console-common MAVEN version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.0.1 -...

org.glassfish.main.admingui:console-cluster-plugin (4.0-b72), org.glassfish.main.admingui:console-common-full-plugin (4.0-b72) +8 more potentially affected by CVE-2024-9408 via org.glassfish.main.admingui:console-common (4.0-b72)

org.glassfish.main.admingui:console-common MAVEN version 4.0-b72 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 4.0-b72 -...

org.glassfish.main.admingui:console-cluster-plugin (3.1.2.2), org.glassfish.main.admingui:console-common-full-plugin (3.1.2.2) +6 more potentially affected by CVE-2024-9408 via org.glassfish.main.admingui:console-common (3.1.2.2)

org.glassfish.main.admingui:console-common MAVEN version 3.1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 3.1.2.2 -...