Geo Network Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

Summary: Two GeoNetwork flaws can be chained for unauthenticated remote code execution: CVE-2026-63219 (CVSS 8.6) is a missing authorization check on the formatter upload endpoint that lets an anonymous user write arbitrary .xsl or .zip files, and CVE-2026-58400 (CVSS 9.1) is an unsafe Saxon XSLT configuration that lets a loaded stylesheet call java.lang.Runtime.exec() or java.lang.ProcessBuilder and run OS commands as the GeoNetwork process user. Fixes shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with details published August 31; Ethiack, whose researcher Rafael Castilho reported the flaws, fingerprinted 121 internet-exposed vulnerable deployments across 39 countries, 89 percent of them government-, military-, or national-agency-related.
Why it matters: Ethiack's scan found 121 exposed instances of this catalog backend, and 89 percent of them belong to government, military, or national agencies - the same class of organizations that run the geoportals GeoNetwork sits behind, including the European INSPIRE backend.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-36401 CVE-2025-58360 CVE-2026-58400 CVE-2026-63219
Related: ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More Cyber Risks ·
CISA Flags Actively Exploited Geo Server XXE Flaw in Updated KEV Catalog Cyber Risks ·
CVE-2025-58360: OSGeo Geo Server Improper Restriction of XML External Entity Reference Vulnerability Known Exploited Vulnerabilities · Dec 11, 2025