CISA Flags Actively Exploited Geo Server XXE Flaw in Updated KEV Catalog

Summary: CISA added CVE-2025-58360, a high-severity (CVSS 8.2) unauthenticated XML External Entity flaw in OSGeo GeoServer, to its Known Exploited Vulnerabilities catalog on Thursday based on evidence of active exploitation. The flaw affects all versions up to and including 2.25.5 and versions 2.26.0 through 2.26.1, is reached through the /geoserver/wms GetMap operation, and has been patched in versions 2.25.6, 2.26.2, 2.27.0, 2.28.0, and 2.28.1.
What's compelling: Successful exploitation lets an attacker read arbitrary files from the server, use SSRF to reach internal systems, or exhaust resources in a denial-of-service, and FCEB agencies have until January 1, 2026 to apply fixes. A separate GeoServer flaw, CVE-2024-36401 at CVSS 9.8, has already been exploited by multiple threat actors over the past year.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2024-36401 CVE-2025-58360
Related: Geo Network Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends Cyber Risks ·
CVE-2025-58360: OSGeo Geo Server Improper Restriction of XML External Entity Reference Vulnerability Known Exploited Vulnerabilities · Dec 11, 2025
CVE-2024-36401: OSGeo Geo Server Geo Tools Eval Injection Vulnerability Known Exploited Vulnerabilities · Jul 15, 2024