CVE-2026-2587
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2587?
CVE-2026-2587 is classified as a critical Remote Code Execution vulnerability.
How does CVE-2026-2587 affect Eclipse GlassFish?
CVE-2026-2587 affects Eclipse GlassFish by allowing attackers to execute arbitrary code via the server-side template rendering mechanism.
What are the potential impacts of CVE-2026-2587?
The potential impacts of CVE-2026-2587 include unauthorized system access and complete control over the affected server.
How can I mitigate CVE-2026-2587?
To mitigate CVE-2026-2587, it is recommended to update to the latest version of Eclipse GlassFish that patches the vulnerability.
Is CVE-2026-2587 related to user input?
Yes, CVE-2026-2587 is related to how the application processes user-supplied values within XML files.