PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2587 Eclipse Foundation CVE debrief

CVE-2026-2587 describes a critical server-side Expression Language (EL) injection issue in a Glassfish-related gadget handling path. The supplied description indicates that untrusted values from .xml input are evaluated without proper sanitization or escaping, and a test payload such as #{7*7} returns 49, confirming server-side expression evaluation. The reported impact is severe: remote attackers may be able to execute arbitrary code on the server, leading to full host compromise. NVD currently lists the record as "Undergoing Analysis," and the vendor/product attribution in the supplied corpus remains low confidence.

Vendor
Eclipse Foundation
Product
Eclipse Glassfish
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-21
Advisory published
2026-05-19
Advisory updated
2026-05-21

Who should care

Teams that maintain or operate Java web applications, XML ingestion endpoints, or any server-side template/EL rendering path should treat this as critical. Security engineering, application owners, and platform administrators should prioritize review if their deployments use Glassfish-adjacent components or any code path that evaluates user-controlled expressions.

Technical summary

The supplied NVD data maps this issue to CWE-917 and a CVSS 3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, reflecting remote reachability and high impact. The core problem is unsafe evaluation of user-controlled input inside a server-side rendering context: crafted XML content can trigger EL processing instead of being treated as data. The corpus also includes a reference to an Eclipse CVE assignment issue, but it does not provide a confirmed product/version or affected CPE list.

Defensive priority

Immediate. Treat as a high-severity server-side code execution risk and prioritize triage, containment, and patch validation as soon as authoritative remediation guidance is available.

Recommended defensive actions

  • Inventory applications and services that parse untrusted XML or use server-side EL/template rendering, especially any Glassfish-related gadget handling code paths.
  • Temporarily disable or restrict processing of untrusted XML and any dynamic expression evaluation on inputs that can be influenced by remote users.
  • Apply vendor or project guidance and patches as soon as they are published; monitor the Eclipse CVE assignment issue and the NVD record for confirmed affected products and fixes.
  • Add server-side allowlisting and strict parsing controls so expression delimiters and template syntax are not evaluated from user-controlled fields.
  • Review logs and request telemetry for suspicious XML submissions, unexpected expression expansion, or anomalous template-rendering failures.
  • If immediate patching is not possible, place the affected service behind additional access controls and reduce exposure to untrusted traffic.

Evidence notes

The supplied corpus includes the NVD record, which marks the vulnerability status as "Undergoing Analysis," provides CWE-917, and lists the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. NVD also references https://gitlab.eclipse.org/security/cve-assignment/-/issues/86 as the source reference. The corpus does not include a confirmed affected product/version list or CPE criteria, so vendor attribution should remain provisional.

Official resources

First published in the CVE/NVD record on 2026-05-19 and modified the same day. In the supplied corpus, the record remains under analysis, so affected product details are still not fully confirmed.