CVE-2026-2587
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk46th percentile — higher than 46% of all known CVEs
Summary
A critical Remote Code Execution (RCE) vulnerability in the Glassfish server-side template rendering mechanism. The application processes .xml files and evaluates EL expressions without proper sanitization, allowing an attacker to fully compromise the host.
Risk Assessment
An attacker can fully compromise the system, read/modify data, execute arbitrary commands, establish persistence, and perform lateral movement within the network.
Recommendation
Immediately update Eclipse GlassFish to version 8.0.2, 7.1.1, or 7.0.26 depending on the branch used. For versions 5.1.0-6.2.5, contact the vendor or apply temporary mitigations.
Original NVD description (English source)
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.