CVE-2026-2587: GlassFish's gadget handler is vulnerable to RCE
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping.
Published May 19, 2026 · Updated Jun 4, 2026
Affected packages
org.glassfish.main.admingui:admingui
- Ecosystem
- Maven
- Affected
- < 8.0.2
- Fixed in
- 8.0.2
- Check
mvn dependency:tree -Dincludes=org.glassfish.main.admingui:admingui
org.glassfish.jsftemplating:jsftemplating
- Ecosystem
- Maven
- Affected
- < 4.2.0
- Fixed in
- 4.2.0
- Check
mvn dependency:tree -Dincludes=org.glassfish.jsftemplating:jsftemplating
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{7*7}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology