CVE-2026-2587
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A critical remote code execution vulnerability in the server-side template rendering mechanism used by the Glassfish gadget handler allows an attacker to inject EL expressions, leading to full host compromise.
Risk Assessment
An attacker can read/modify data, execute arbitrary commands, establish persistence, and move laterally, posing a serious threat to the entire infrastructure.
Recommendation
Immediately update Eclipse GlassFish to version 8.0.2, 7.1.1, or 7.0.26 depending on the branch, and disable unnecessary gadget handlers.
Other vulnerabilities in Eclipse GlassFish
See all- CVE-2026-12605Critical
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console, leading to full unauthenticated takeover of the GlassFish domain until the token expires.
- CVE-2026-2586Critical
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
- CVE-2024-9342Critical
In Eclipse GlassFish versions before 8.0.3, it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.
- CVE-2022-2712Medium
Relative path traversal vulnerability in Eclipse GlassFish versions 5.1.0 to 6.2.5. Unauthenticated remote attacker can access configuration files and application source code. Fixed in GlassFish 7.0.0.
Original NVD description (English source)
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS