CVE-2026-2587

Katalog CVE

CVSS 9.6 · Critical EPSS 0,67%

Kerentanan Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') pada eclipse glassfish. Skor CVSS 3.1 9.6 (Critical) menurut eclipse.org.

Deskripsi (NVD)

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

Rincian

Terbit di NVD

19 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber eclipse.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.eclipse.org/security/cve-assignment/-/issues/86 exploit · issue tracking · advisory pihak ketiga