Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-2587

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Eclipse Glassfish

Default version status: unaffected

  • 5.1.0 to ≤ 6.2.5unknown
  • 7.0.0 to < 7.0.26affected
  • 7.1.0 to < 7.1.1affected
  • 8.0.0 to < 8.0.2affected

References