CVE-2023-5763

Eclipse GlassFish 5 and 6 expose insecure ORB listeners that let a remote attacker load malicious code onto the server — but only when the host runs an old JDK, specifically below 6u211, 7u201, or 8u191. The flaw is really a dangerous interaction: GlassFish's ORB listeners plus an outdated Java runtime combine into a remote code-loading path. On a current JDK, that path is closed.

The JDK precondition and the high attack complexity are why this is a 6.8 rather than a straight critical RCE, and both are honest limiters. A patched Java runtime — anything past those update levels — removes the exposure entirely, so the truly at-risk population is servers running both GlassFish and a long-unpatched JDK. Where that combination exists it's genuinely exploitable for code loading; where it doesn't, this doesn't apply.

That makes this a dependency-and-configuration triage rather than a raw GlassFish patch. Our determining question is the JDK version underneath each GlassFish instance, because that single fact decides whether the host is vulnerable at all. We'd rank a GlassFish server on a modern JDK low and one on an ancient JDK as a real code-execution exposure — and updating the runtime is the cleanest fix, closing this without touching the app server.