Loading story…
Researchers disclosed four vulnerabilities in GeoNetwork that can be chained to achieve pre-authentication remote code execution. The attack path reportedly combines an unauthenticated file-upload capability with unsafe XSLT processing, allowing an unauthenticated attacker to upload crafted content and trigger code execution on a vulnerable server.
The exposure reportedly included 121 government deployments. All four flaws have been patched, but organizations operating GeoNetwork should urgently identify internet-facing instances, apply the vendor fixes, restrict unauthenticated upload paths, and review server and application logs for anomalous uploads or XSLT-processing activity.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-58400 documented that GeoNetwork's Saxon XSLT formatter processing allowed Java extension functions without secure processing. A user permitted to upload formatters could upload a malicious stylesheet to execute operating-system commands as the GeoNetwork process user; versions 4.4.12 and 4.2.17 remediate the issue.
CISA’s SSVC record for CVE-2026-63219 assessed exploitation as none, automatable as yes, and technical impact as partial. The missing-authorization flaw in GeoNetwork’s formatter-upload API was remediated in versions 4.4.12 and 4.2.17.
The report stated that all four disclosed GeoNetwork vulnerabilities had been patched; it did not provide patch versions or release dates.
A security report described four GeoNetwork vulnerabilities, including an unauthenticated file-upload issue and unsafe XSLT processor behavior, that can be chained for pre-authentication remote code execution. The report identified 121 government GeoNetwork deployments in connection with the exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcethehackernews.com
Open sourcereddit.com
Open sourceethiack.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively targeting an unpatched **GeoServer** zero-day shortly after public disclosure, with researchers observing hundreds of exploitation attempts against exposed systems. The flaw is an **SQL injection** issue in GeoServer’s `jsonArrayContains` function and can lead to **remote code execution** in certain deployments, particularly those using **PostGIS** and **Oracle JDBC** data stores. Security researcher **q1uf3ng** publicly disclosed the vulnerability, and **WatchTowr** reported that a small number of source IP addresses began probing for vulnerable servers within hours. Although the observed activity has so far appeared focused on reconnaissance and exploitation attempts rather than confirmed post-compromise actions, defenders were urged to identify internet-exposed GeoServer instances, limit public access where possible, and watch for an official vendor patch because no fix was available at the time of reporting.
Aug 18, 2026
Threat actors exploited a critical remote code execution vulnerability (CVE-2024-36401) in the open-source GeoServer platform to breach a U.S. federal civilian executive branch agency. The attackers gained initial access to one GeoServer instance and, over a three-week period, used the same vulnerability to compromise a second GeoServer and move laterally to additional servers, including web and SQL servers. The attackers deployed web shells such as China Chopper, leveraged scripts for persistence and privilege escalation, and used living-off-the-land techniques to evade detection. The breach was detected after the agency's endpoint detection and response (EDR) tool flagged suspicious activity, prompting a CISA-led incident response. CISA noted deficiencies in the agency's response playbook, which allowed the attackers to maintain deeper access during the investigation.
Jun 29, 2026
Cisco Talos disclosed newly patched vulnerabilities in **GeoVision** products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans **14 advisories and 37 CVEs**, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that **Snort coverage** is available to help detect exploitation attempts. Reporting on the GeoVision issues highlighted critical flaws in **LPC2011/LPC2211** license-plate recognition cameras and **GV-VMS** software. In particular, `CVE-2026-42364` is an OS command injection in `DdnsSetting.cgi` on camera firmware `1.10`, and `CVE-2026-42368` is a privilege-escalation bug that can be chained for full **root compromise** through the web interface; a separate flaw, `CVE-2026-42369`, enables unauthenticated remote code execution in **GV-VMS V20**. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.
Jul 10, 2026