An authenticated user who can access the GlassFish Administration Console can send specially crafted requests that cause the server to execute arbitrary operating system commands with the privileges of the application service user. The flaw is a classic OS command injection (CWE-917), which allows an attacker to run arbitrary code on the host system.

The vulnerability affects Eclipse Glassfish products. No specific version information is listed in the CNA data, so all releases that include the vulnerable Administration Console implementation may be impacted.

The CVSS score of 9.1 indicates a critical level of severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. The likely attack vector requires an attacker to first authenticate to the Administration Console; once authenticated, the attacker can deliver malicious requests that trigger the command execution flaw.