CVE-2026-2587

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://gitlab.eclipse.org/security/cve-assignment/-/issues/86	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-19 15:16

Updated : 2026-07-24 12:10

NVD link : CVE-2026-2587

Mitre link : CVE-2026-2587

CVE.ORG link : CVE-2026-2587

JSON object : View

Products Affected

eclipse

glassfish

CWE

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

{"id": "CVE-2026-2587", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2587", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"repo": "https://github.com/eclipse-ee4j/glassfish", "vendor": "Eclipse Foundation", "product": "Eclipse Glassfish", "versions": [{"status": "unknown", "version": "5.1.0", "versionType": "semver", "lessThanOrEqual": "6.2.5"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.26", "versionType": "semver"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.1", "versionType": "semver"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-19T15:16:28.577", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/86", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "emo@eclipse.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-917"}]}], "descriptions": [{"lang": "en", "value": "A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) \u201cexpressions\u201d are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown."}, {"lang": "es", "value": "Una cr\u00edtica vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) fue identificada en el mecanismo de renderizado de plantillas del lado del servidor utilizado por el gestor de gadgets de Glassfish. La aplicaci\u00f3n procesa archivos .xml y eval\u00faa valores proporcionados por el usuario dentro de un contexto donde las 'expresiones' de Expression Language (EL) son procesadas sin una sanitizaci\u00f3n o escape adecuados. Al inyectar expresiones como #{77}, el servidor devuelve 49, confirmando la evaluaci\u00f3n de EL del lado del servidor. Este problema permite a un atacante remoto comprometer completamente el host subyacente, habilitando capacidades como leer/modificar datos, ejecutar comandos arbitrarios, persistencia y movimiento lateral."}], "lastModified": "2026-07-24T12:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "589D2C3E-E047-4F09-B0CC-878611D553DB", "versionEndExcluding": "8.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}