CVE-2026-2587

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2587", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-02-16T14:14:23.896Z", "datePublished": "2026-05-19T14:03:18.650Z", "dateUpdated": "2026-06-29T08:41:24.518Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-06-29T08:41:24.518Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-917", "description": "CWE-917 Improper neutralization of special elements used in an expression language statement ('expression language injection')", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Glassfish", "repo": "https://github.com/eclipse-ee4j/glassfish", "versions": [{"status": "unknown", "version": "5.1.0", "lessThanOrEqual": "6.2.5", "versionType": "semver"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.26", "versionType": "semver"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.1", "versionType": "semver"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) \u201cexpressions\u201d are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) \u201cexpressions\u201d are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown."}]}], "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/86"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Camilo G. AkA Dedalo (DeepSecurity Per\u00fa)", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "source": {"discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-2587"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T03:55:38.111Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T14:40:15.390418Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T14:40:21.559Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Camilo G. AkA Dedalo (DeepSecurity Per\u00fa)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/eclipse-ee4j/glassfish", "vendor": "Eclipse Foundation", "product": "Eclipse Glassfish", "versions": [{"status": "unknown", "version": "5.1.0", "versionType": "semver", "lessThanOrEqual": "6.2.5"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.26", "versionType": "semver"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.1", "versionType": "semver"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/86"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) \u201cexpressions\u201d are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.", "supportingMedia": [{"type": "text/html", "value": "A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) \u201cexpressions\u201d are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-917", "description": "CWE-917 Improper neutralization of special elements used in an expression language statement ('expression language injection')"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-06-29T08:41:24.518Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2587", "state": "PUBLISHED", "dateUpdated": "2026-06-29T08:41:24.518Z", "dateReserved": "2026-02-16T14:14:23.896Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-05-19T14:03:18.650Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eclipse Glassfish", "repo": "https://github.com/eclipse-ee4j/glassfish", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "6.2.5", "status": "unknown", "version": "5.1.0", "versionType": "semver"}, {"lessThan": "7.0.26", "status": "affected", "version": "7.0.0", "versionType": "semver"}, {"lessThan": "7.1.1", "status": "affected", "version": "7.1.0", "versionType": "semver"}, {"lessThan": "8.0.2", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "source": "emo@eclipse.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:*", "matchCriteriaId": "589D2C3E-E047-4F09-B0CC-878611D553DB", "versionEndExcluding": "8.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) \u201cexpressions\u201d are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown."}, {"lang": "es", "value": "Una cr\u00edtica vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) fue identificada en el mecanismo de renderizado de plantillas del lado del servidor utilizado por el gestor de gadgets de Glassfish. La aplicaci\u00f3n procesa archivos .xml y eval\u00faa valores proporcionados por el usuario dentro de un contexto donde las 'expresiones' de Expression Language (EL) son procesadas sin una sanitizaci\u00f3n o escape adecuados. Al inyectar expresiones como #{77}, el servidor devuelve 49, confirmando la evaluaci\u00f3n de EL del lado del servidor. Este problema permite a un atacante remoto comprometer completamente el host subyacente, habilitando capacidades como leer/modificar datos, ejecutar comandos arbitrarios, persistencia y movimiento lateral."}], "id": "CVE-2026-2587", "lastModified": "2026-07-24T12:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "emo@eclipse.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2587", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-19T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-19T15:16:28.577", "references": [{"source": "emo@eclipse.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/86"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-917"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.0.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Eclipse Glassfish", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "glassfish", "vendor": "eclipse"}], "created": "2026-05-19T15:30:08.161469+00:00", "updated": "2026-06-29T10:00:11.576260+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$glassfish"]}