CVE-2026-2587: Critical RCE in Glassfish Gadget Handler

A critical Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-2587, has been identified in the server-side template rendering mechanism of the Glassfish gadget handler. The National Vulnerability Database reports this flaw stems from improper sanitization of user-supplied values within XML files, where Expression Language (EL) ‘expressions’ are processed.

Attackers can inject EL expressions, such as #{7*7}, to confirm server-side evaluation. This successful injection demonstrates the ability to execute arbitrary code, leading to full compromise of the underlying host. The National Vulnerability Database rates this vulnerability with a CVSS score of 9.6 (CRITICAL), highlighting the severe implications including data exfiltration, command execution, persistence, and lateral movement.

While specific affected products were not detailed by the National Vulnerability Database, organizations utilizing Glassfish or similar server-side template rendering technologies that process user-supplied XML should assume exposure. The attacker’s calculus here is straightforward: exploit an unsanitized input to gain RCE, a direct path to full system control. Defenders must prioritize patching and rigorous input validation.