Loading story…
GeoServer and Apache CXF disclosed separate XML External Entity vulnerabilities that could let attackers abuse unsafe XML parsing to access sensitive resources. In GeoServer, CVE-2025-30220 affects the Web Feature Service (WFS) through the GeoTools library, where in-memory XSD schema processing does not enforce GeoServer’s ENTITY_RESOLUTION_ALLOWLIST restriction. The flaw can enable information disclosure and server-side request forgery (SSRF) via malicious XML containing external entities or DTDs, with affected GeoServer versions including 2.27.0, 2.26.0 through 2.26.2, and versions up to 2.25.6.
Apache also disclosed CVE-2026-44618, an important-severity XXE flaw in the WS-Transfer functionality of Apache CXF caused by an insecure XML parser configuration. Affected versions include org.apache.cxf:cxf-rt-ws-transfer 4.2.0 before 4.2.1, 4.0.0 before 4.1.6, and all 3.6.x releases before 3.6.11. Vendors urged organizations to upgrade to fixed releases immediately; where GeoServer patching is delayed, defenders were advised to restrict access to WFS endpoints and monitor for suspicious XML requests and outbound activity consistent with SSRF attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2026-44618, an important-severity XXE vulnerability in Apache CXF's WS-Transfer functionality caused by insecure XML parser configuration. Affected versions include 4.2.0 before 4.2.1, 4.0.0 before 4.1.6, and all 3.6.x versions before 3.6.11, with upgrades recommended to the fixed releases.
Kudelski Security published technical analysis of CVE-2025-30220, identifying affected GeoServer versions including 2.27.0, 2.26.0 through 2.26.2, and versions up to 2.25.6. It advised immediate upgrades, restricting access to WFS endpoints if patching is delayed, and monitoring for suspicious XML and SSRF-related activity.
GeoServer disclosed CVE-2025-30220, a high-severity XML External Entity vulnerability in its Web Feature Service caused by GeoTools schema processing bypassing the ENTITY_RESOLUTION_ALLOWLIST restriction. The issue can enable information disclosure and SSRF via malicious XML payloads using external entities or DTDs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcekudelskisecurity.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has added CVE-2025-58360, a critical XML External Entity (XXE) vulnerability in OSGeo GeoServer, to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. This vulnerability affects the Web Map Service (WMS) GetMap operation, allowing unauthenticated attackers to exploit improperly restricted XML entity references, potentially leading to file disclosure, server-side request forgery (SSRF), and denial-of-service conditions. The flaw impacts multiple 2.25.x and 2.26.x versions of GeoServer, with patches available in later releases such as 2.25.6 and 2.26.2/2.26.3, and has been integrated into public exploit tools and security scanners, increasing the risk of widespread exploitation. CISA’s inclusion of this vulnerability in the KEV catalog mandates federal agencies to remediate affected systems within a set timeframe, underscoring the urgency for all organizations to prioritize patching or isolating vulnerable GeoServer instances. The vulnerability is particularly concerning due to GeoServer’s role in managing geospatial data for critical infrastructure, government, and enterprise GIS deployments, making exploitation a significant risk for data exposure and internal network compromise. CISA strongly recommends that all organizations, not just federal agencies, address this vulnerability as part of their vulnerability management practices to mitigate the threat of active cyberattacks.
Jun 29, 2026
Attackers are actively targeting an unpatched **GeoServer** zero-day shortly after public disclosure, with researchers observing hundreds of exploitation attempts against exposed systems. The flaw is an **SQL injection** issue in GeoServer’s `jsonArrayContains` function and can lead to **remote code execution** in certain deployments, particularly those using **PostGIS** and **Oracle JDBC** data stores. Security researcher **q1uf3ng** publicly disclosed the vulnerability, and **WatchTowr** reported that a small number of source IP addresses began probing for vulnerable servers within hours. Although the observed activity has so far appeared focused on reconnaissance and exploitation attempts rather than confirmed post-compromise actions, defenders were urged to identify internet-exposed GeoServer instances, limit public access where possible, and watch for an official vendor patch because no fix was available at the time of reporting.
Aug 15, 2026
The Apache Software Foundation released security updates for **Apache CXF** to fix three newly disclosed vulnerabilities affecting enterprise deployments of the services framework. The flaws include **`CVE-2026-44930`**, an LDAP injection issue in the XKMS LDAP certificate repository that can let attackers manipulate backend search filters and retrieve arbitrary digital certificates, potentially enabling impersonation, interception of encrypted communications, and lateral movement. Apache also addressed an **XXE** flaw in WS-Transfer caused by insecure XML parser configuration, which could expose sensitive files and support internal network mapping, as well as a possible **remote code execution** condition tied to an incomplete fix for an older JMS-related bug. Affected releases include **4.2.0**, **4.0.0 through 4.1.5**, and older branches before **3.6.11**. Apache published patched versions **4.2.1**, **4.1.6**, and **3.6.11**, and guidance urges organizations to upgrade immediately, review LDAP access controls, monitor certificate access activity, and reduce exposure of XKMS components where possible. The disclosures indicate that while the LDAP flaw does not itself provide code execution, the combined set of weaknesses could materially affect trust infrastructure and server security in vulnerable environments.
Jun 29, 2026