Eclipse GlassFish CVE-2026-2587

Exploitation requires (1) network reachability to the GlassFish gadget handler endpoint that processes .xml files, (2) the gadget handler component being deployed and enabled in the target instance, and (3) user interaction (UI:R) - typically a victim opening or being redirected to a URL that triggers server-side rendering of an attacker-controlled .xml template with #{...} or ${...} expressions in user-supplied values. Authentication is not required per PR:N, and attack complexity is low (AC:L) against the affected gadget rendering path. Limiting factors: deployments that do not expose or use the gadget handler, that front GlassFish with a WAF blocking EL meta-characters, or that isolate the admin/gadget interface to a management network are not reachable by unauthenticated internet attackers; the UI:R requirement also means purely autonomous mass exploitation is unlikely without a social-engineering or chained CSRF vector.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H describes a network-reachable, low-complexity, unauthenticated bug whose only meaningful prerequisite is user interaction, and whose scope changes with high impact across confidentiality, integrity, and availability - entirely consistent with EL-injection-to-RCE. There is no EPSS score, no CISA KEV listing, and no published proof-of-concept referenced in the provided intelligence, so exploitation pressure is currently unquantified; the only artifact is the Eclipse GitLab issue. The UI:R requirement is the chief mitigator (an admin or victim must trigger the gadget rendering path), which tempers the otherwise worst-case profile, but CWE-917 bugs in Java servers historically yield reliable RCE once a trigger is found, so this should be treated as a high-priority patch candidate rather than dismissed because no exploit is yet public. Data gap to flag: affected version ranges are wildcarded in the CPE and no fix version is published in the available references - the exact patched build must be confirmed with the Eclipse advisory before remediation planning.

An attacker hosts or emails a link to a malicious .xml gadget URL on a vulnerable GlassFish instance and convinces an authenticated operator or any user with access to the gadget handler to load it (satisfying UI:R); when the server renders the template, the attacker's #{...} expression is evaluated in the JVM and yields arbitrary Java/OS command execution. Because scope is changed (S:C), the attacker pivots from the gadget rendering context to the underlying server identity, then reads configuration, drops a webshell, or moves laterally. No public exploit identified at time of analysis, but the description itself documents the #{7*7} → 49 detection primitive that any tester can adapt into a working payload.