PT-2026-41933 · Eclipse · Glassfish

Published 2026-05-19 · Updated 2026-05-30 · CVE-2026-2587

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse GlassFish version 8.0.0 Eclipse GlassFish versions prior to 7.1.0

Description A critical Expression Language (EL) injection issue exists in the server-side template rendering mechanism used by the GlassFish gadget handler. The application processes .xml files and evaluates user-supplied values without proper sanitization or escaping. This allows a remote attacker to inject expressions, such as #{7*7}, to achieve remote code execution, which can lead to full compromise of the underlying host, including reading or modifying data, executing arbitrary commands, establishing persistence, and lateral movement.

Recommendations Restrict the processing of untrusted XML input. Monitor Eclipse security advisories for remediation guidance.

Exploit

Fix

RCE

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2026-2587

GHSA-29WV-CV7P-XJC2

Affected Products

Glassfish

References · 8

• 🔥 https://gitlab.eclipse.org/security/cve-assignment/-/issues/86 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2587 · Security Note
• https://osv.dev/vulnerability/GHSA-29wv-cv7p-xjc2 · Vendor Advisory
• https://github.com/eclipse-ee4j/glassfish · Note
• https://github.com/eclipse-ee4j/glassfish/releases/tag/8.0.2 · Note
• https://twitter.com/DFIR_Lab/status/2060512845410758686 · Twitter Post
• https://twitter.com/UpwindMDR/status/2056865264671547433 · Twitter Post
• https://twitter.com/CVEnew/status/2056870220317237358 · Twitter Post