Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-19 | 2 | Disclosure2 |
| 2026-05-20 | 1 | General1 |
| 2026-05-30 | 1 | Patch1 |
🚨 CRITICAL: CVE-2026-2587 (CVSS 9.6) - RCE in Glassfish gadget handler via unsanitized Expression Language processing in .xml files. Remote attackers can achieve full host compromise. Patch immediately. #CVE #PatchNow https://t.co/K765oc5DuM
Post summary
The tweet announces a critical RCE in Glassfish (CVE‑2026‑2587) and urges immediate patching, but does not provide PoC code or evidence of active exploitation.
🚨 Critical - Eclipse GlassFish EL Injection RCE (CVE-2026-2587) A critical Expression Language (EL) injection vulnerability in Eclipse GlassFish may allow remote attackers to achieve full remote code execution through crafted .xml files processed by the GlassFish gadget handler. The issue affects GlassFish 8.0.0 and versions prior to 7.1.0 on both Windows and Linux. Successful exploitation may lead to arbitrary command execution, persistence, data compromise, and lateral movement. 👉 Administrators should restrict processing of untrusted XML input and monitor Eclipse security advisories for remediation guidance.
Post summary
The post announces CVE-2026-2587, an EL injection leading to RCE in Eclipse GlassFish, and advises admins to restrict XML processing and consult advisories for remediation.
#cve-2026-2587 https://t.co/7DetEsQHC3
Post summary
This tweet only references CVE-2026-2587 and includes a link, but no further information is provided.
CVE-2026-2587 A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The applicatio… https://www.cve.org/CVERecord?id=CVE-2026-2587
Post summary
The text announces a critical RCE vulnerability (CVE‑2026‑2587) in Glassfish’s gadget handler, providing basic technical details but no exploit, patch, or exploitation evidence.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | eclipse | glassfish | - | - | - |