GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
GeoNetwork patched two chained flaws (CVE-2026-63219, CVE-2026-58400) enabling unauthenticated RCE in government geospatial metadata catalogs.
Two flaws in the open-source GeoNetwork catalog chain into unauthenticated RCE: a missing authorization check on the formatter upload endpoint (CVE-2026-63219, CVSS 8.6) and an unsafe Saxon XSLT processor configuration allowing Java execution (CVE-2026-58400, CVSS 9.1). Fixes shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with details published August 31. Ethiack fingerprinted 121 internet-exposed vulnerable deployments across 39 countries, 89% tied to government or military agencies. No exploitation in the wild or KEV listing was reported at disclosure.
- Chain: unauthenticated formatter upload (.xsl/.zip) plus Saxon XSLT allowing java.lang.Runtime.exec()
- Fixed in GeoNetwork 4.4.12 and 4.2.17; interim mitigation blocks POST/PUT/PATCH to the formatter endpoint
- Chain reachable since version 4.0.6; affects all 4.4.x up to 4.4.11 and 4.2.x up to 4.2.16
- No CISA KEV entry or public exploitation reports at disclosure time
- Follows recent GeoServer flaws including exploited CVE-2024-36401 and KEV-listed CVE-2025-58360
- Products
- GeoNetwork
- Organizations
- Ethiack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-36401 | Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2025-58360 | Actively Exploited XXE in OSGeo GeoServer WMS GetMap Endpoint | 9.8 | 61% | KEV | KEV |
CVE-2026-58400+1 related CVE | Arbitrary Command Execution via Saxon XSLT in GeoNetwork Formatters | 9.1 group max | 1% |
From the original article
3 min read at thehackernews.com
Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. The project shipped fixes in versions 4. 4.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.