CVE-2026-2587
A critical flaw in Eclipse GlassFish lets attackers run arbitrary code on the server by injecting unsanitized Expression Language expressions into XML files. The vulnerability is triggered when the server processes user‑supplied data without proper escaping, allowing remote code execution. It can be fully mitigated by updating to a patched version.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Eclipse GlassFish versions 7.0.0‑7.0.25, 7.1.0, and 8.0.0‑8.0.1 are vulnerable. Versions 7.0.26, 7.1.1, and 8.0.2 or later contain the fix. Impact on 5.1.0‑6.2.5 is unknown.
Real-world impact
An attacker who exploits this flaw can take complete control of the host, read or modify data, run arbitrary commands, establish persistence, and move laterally within the network.
Why this severity
The CVSS score of 9.6 reflects the vulnerability’s high exploitability (network access, low effort), lack of authentication, and the fact that it allows full compromise of confidentiality, integrity, and availability. The vector shows that a user interface is required, but the impact is catastrophic.
What to do about it
- 01Upgrade Eclipse GlassFish to version 8.0.2 or later, or to 7.1.1 or later, or to 7.0.26 or later.
- 02Restart the GlassFish server after applying the update.
NVD-referenced vendor advisory
Timeline
- May 19, 2026 · May 19, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- gitlab.eclipse.org/security/cve-assignment/-/i…exploitissue trackingthird party advisory