{
  "port": 8686,
  "protocol": "tcp",
  "service": "GlassFish JMX/RMI (sun-as-jmxrmi)",
  "oneLiner": "The JMX remote management connector for GlassFish and its Sun Application Server ancestors.",
  "whatItIs": "IANA registers sun-as-jmxrmi on 8686, \"Sun App Server - JMX/RMI\", from 2005. GlassFish still uses it: the administration guide lists 8686 as the \"Pure JMX Clients Port\" and shows the domain creation output naming it JMX_ADMIN, with JConsole connecting to service:jmx:rmi://host:8686/jndi/rmi://host:8686/jmxrmi. It appears on Java application servers of that lineage — GlassFish, Payara, and older Sun/Oracle Application Server installs. A JMX connector exposes MBeans that can read and change server configuration at runtime.",
  "exposure": {
    "verdict": "never",
    "note": "Remote JMX/RMI is a management plane, and unauthenticated JMX endpoints are a well-worn route to code execution on the JVM. Bind it to localhost and tunnel, or require authentication and TLS on the connector."
  },
  "checkCommand": "nc -vz TARGET 8686",
  "links": [
    {
      "title": "Eclipse GlassFish Administration Guide (JMX port 8686)",
      "url": "https://glassfish.org/docs/latest/administration-guide.html",
      "kind": "official-docs"
    },
    {
      "title": "Eclipse GlassFish source repository",
      "url": "https://github.com/eclipse-ee4j/glassfish",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}