CVEFinder.io

CVE-2026-2587

⛔ critical
🔍 Scan for this CVE
Summary

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise

Description

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

CVSS Score
9.6
Critical
EPSS Score
0.7
Exploit Probability
Published Date
2026-05-19
First Seen: 2026-05-20
📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.1% of all 342,933 vulnerabilities in our database.

#33,804
Top 10% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 19, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Camilo G. AkA Dedalo (DeepSecurity Perú)
SSVC data provided by CISA
Last Modified 2026-07-24
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-917

📦 Affected Products 1

Vendor Product Status Affected Versions
eclipse glassfish Affected
< 8.0.2

🔗 References 1

https://gitlab.eclipse.org/security/cve-assignment/-...
Exploit Issue Tracking Third Party Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-12605 ⛔ critical 9.6 0.2 In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfrestt... 2026-08-06
CVE-2026-2586 ⛔ critical 9.1 0.8 An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user ... 2026-05-19
CVE-2024-10029 🔶 medium 6.1 0.0 In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration ... 2025-07-16
CVE-2024-10031 🔶 medium 5.4 0.0 In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configur... 2025-07-16
CVE-2024-10032 🔶 medium 5.4 0.0 In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Con... 2025-07-16
CVE-2024-9342 ⛔ critical 9.8 0.4 In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation... 2025-07-16
These CVEs affect the same products