{"cve":"CVE-2026-2587","nvd":{"published":"2026-05-19T15:16:28.577","modified":"2026-07-24T12:10:00.210","status":"Modified","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-917"],"references":["https://gitlab.eclipse.org/security/cve-assignment/-/issues/86"],"products":["eclipse:glassfish"],"source":"nvd","synced_at":"2026-10-19T22:35:16.954578616+00:00"},"epss":{"cve":"CVE-2026-2587","score":0.00646,"percentile":0.50958,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-29wv-cv7p-xjc2","url":"https://osv.dev/vulnerability/GHSA-29wv-cv7p-xjc2","summary":"GlassFish's gadget handler is vulnerable to RCE","modified":"2026-09-10T03:50:45.327078967Z","packages":[{"ecosystem":"Maven","name":"org.glassfish.main.admingui:admingui","purl":"pkg:maven/org.glassfish.main.admingui/admingui","ranges":["<8.0.2"],"fixed":["8.0.2"]},{"ecosystem":"Maven","name":"org.glassfish.jsftemplating:jsftemplating","purl":"pkg:maven/org.glassfish.jsftemplating/jsftemplating","ranges":["<4.2.0"],"fixed":["4.2.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}