CVE-2026-2587
Published: 19 May 2026
Summary
CVE-2026-2587 is a critical-severity Expression Language Injection (CWE-917) vulnerability in Eclipse (inferred from references). Its CVSS base score is 9.6 (Critical).
Operationally, ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
NVD Description
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed…
more
without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)