CVE-2026-2587

🗓️ 19 May 2026 14:03:18Reported by eclipseType

cve🔗 web.nvd.nist.gov👁 13 Views🌐 WEB

Critical remote code execution in Glassfish gadget handler via unsanitized expression language in XML, enabling full host compromise.

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for CVE-2026-2587	20 May 202621:31	–	githubexploit
ATTACKERKB	CVE-2026-2587	19 May 202614:03	–	attackerkb
Circl	CVE-2026-2587	20 May 202601:00	–	circl
CNNVD	Eclipse Glassfish 安全漏洞	19 May 202600:00	–	cnnvd
Cvelist	CVE-2026-2587	19 May 202614:03	–	cvelist
EUVD	EUVD-2026-30941	19 May 202614:03	–	euvd
Github Security Blog	GlassFish's gadget handler is vulnerable to RCE	19 May 202615:31	–	github
NVD	CVE-2026-2587	19 May 202615:16	–	nvd
OSV	GHSA-29WV-CV7P-XJC2 GlassFish's gadget handler is vulnerable to RCE	19 May 202615:31	–	osv
Positive Technologies	PT-2026-41933	19 May 202600:00	–	ptsecurity

NVD

Node

eclipse glassfishRange<8.0.2

[
  {
    "vendor": "Eclipse Foundation",
    "product": "Eclipse Glassfish",
    "repo": "https://github.com/eclipse-ee4j/glassfish",
    "versions": [
      {
        "status": "unaffected",
        "version": "8.0.2",
        "lessThanOrEqual": "*",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "affected"
  }
]

Source	Link
gitlab	www.gitlab.eclipse.org/security/cve-assignment/-/issues/86

Parameter	Position	Path	Description	CWE
gadget	query param	common/gadgets/gadget.jsf	EL injection via gadget parameter leading to server-side expression evaluation (RCE).	CWE-917

21 May 2026 13:18Current

6Medium risk

Vulners AI Score6

CVSS 3.19.6

EPSS0.00146

SSVC

CWE-917