{"id":"CVE-2026-2587","aliases":["EUVD-2026-30941","GHSA-29wv-cv7p-xjc2"],"status":"published","title":"GlassFish's gadget handler is vulnerable to RCE","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00646,"percentile":0.51241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-917"],"published":"2026-05-19T14:03:18Z","modified":"2026-11-04T02:45:43Z","exploits":[{"source":"pocgithub","id":"Bhanunamikaze/CVE-2026-2587-Exploit-POC","title":"Bhanunamikaze/CVE-2026-2587-Exploit-POC","date":"2026-05-20","url":"https://github.com/Bhanunamikaze/CVE-2026-2587-Exploit-POC"}],"fixes":[{"ecosystem":"Maven","package":"org.glassfish.main.admingui:admingui","fixed_in":["8.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.glassfish.jsftemplating:jsftemplating","fixed_in":["4.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.glassfish.main.admingui:admingui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.glassfish.jsftemplating:jsftemplating","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.glassfish.main.admingui:admingui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2"}]}],"versions":["3.1.2","3.1.2.2","4.0","4.0-b33","4.0-b72","4.0-b90","4.1","4.1.1","4.1.2","5.0","5.0.1","5.1.0","5.1.0-RC1","5.1.0-RC2","6.0.0","6.0.0-M1","6.0.0-RC1","6.0.0-RC2","6.0.0-RC3","6.0.0-RC4","6.1.0","6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5","7.0.0","7.0.0-M1","7.0.0-M10","7.0.0-M2","7.0.0-M3","7.0.0-M4","7.0.1","7.0.10","7.0.11","7.0.12","7.0.13","7.0.14","7.0.15","7.0.16","7.0.17","7.0.18","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.24","7.0.25","7.0.26","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9","7.1.0","7.1.0-M1","7.1.1","8.0.0","8.0.0-DONTPUBLISH","8.0.0-JDK17-M10","8.0.0-JDK17-M12","8.0.0-JDK17-M5","8.0.0-JDK17-M6","8.0.0-JDK17-M7","8.0.0-JDK17-M9","8.0.0-M1","8.0.0-M10","8.0.0-M11","8.0.0-M12","8.0.0-M13","8.0.0-M14","8.0.0-M15","8.0.0-M2","8.0.0-M3","8.0.0-M5","8.0.0-M6","8.0.0-M7","8.0.0-M8","8.0.0-M9","8.0.1"]},{"source":"osv","ecosystem":"Maven","package":"org.glassfish.jsftemplating:jsftemplating","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}],"versions":["1.2.0-1","1.2.1","1.2.2","1.2.3","3.0.0","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.1.0","4.1.0-M1"]}],"products":[{"vendor":"eclipse","product":"glassfish"},{"vendor":"eclipse foundation","product":"eclipse glassfish"}],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/issues/86","tags":["Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2587","tags":["advisory"]},{"url":"https://github.com/eclipse-ee4j/glassfish/releases/tag/8.0.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-29wv-cv7p-xjc2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2587.json","tags":["advisory"]},{"url":"https://github.com/eclipse-ee4j/glassfish","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-2587","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.","status":"published","published":"2026-05-19T14:03:18.65Z","modified":"2026-06-29T08:41:24.518Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-30941","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.","status":"published","published":"2026-05-19T14:03:18Z","modified":"2026-06-29T08:41:24Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:23.349194Z"}],"ghsa":[{"id":"GHSA-29wv-cv7p-xjc2","title":"GlassFish's gadget handler is vulnerable to RCE","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.","status":"published","published":"2026-05-19T15:31:35Z","modified":"2026-06-04T19:21:22Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-2587","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.","status":"published","published":"2026-05-19T15:16:28.577Z","modified":"2026-07-24T12:10:00.21Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"CVE-2026-2587","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.","status":"published","published":"2026-05-19T14:03:18.65Z","modified":"2026-11-04T02:45:43.213316316Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-917"],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"GHSA-29wv-cv7p-xjc2","title":"GlassFish's gadget handler is vulnerable to RCE","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.","status":"published","published":"2026-05-19T15:31:35Z","modified":"2026-09-10T03:50:45.327078967Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-917"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}