A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.
References
| Link | Resource |
|---|---|
| https://gitlab.eclipse.org/security/cve-assignment/-/issues/86 | Issue Tracking Third Party Advisory Exploit |
Configurations
History
21 May 2026, 13:18
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Eclipse
Eclipse glassfish |
|
| References | () https://gitlab.eclipse.org/security/cve-assignment/-/issues/86 - Issue Tracking, Third Party Advisory, Exploit | |
| CPE | cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:* |
19 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-19 15:16
Updated : 2026-05-21 13:18
NVD link : CVE-2026-2587
Mitre link : CVE-2026-2587
CVE.ORG link : CVE-2026-2587
JSON object : View
Products Affected
eclipse
- glassfish
CWE
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')