Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-01 | 2 | Disclosure2 |
| 2026-09-02 | 3 | Disclosure2PoC1 |
| 2026-09-03 | 1 | Patch1 |
| 2026-09-04 | 1 | Disclosure1 |
| 2026-10-01 | 1 | Disclosure1 |
New unauth RCE in GeoNetwork Popped and reported by @castilho101 💥 CVE-2026-63219, CVE-2026-55864, CVE-2026-57582, CVE-2026-58400 https://t.co/aXkS1L27vw
Post summary
The tweet announces newly discovered unauthenticated RCE vulnerabilities in GeoNetwork, listing several CVEs and linking to a source for further details.
GeoNetwork pre-auth RCE chain: missing auth on formatter upload + unsafe Saxon XSLT. CVE-2026-63219 (8.6): formatter upload dropped Spring PreAuthorize after the 4.0.6 refactor → unauthenticated write of .xsl/.zip. CVE-2026-58400 (9.1): Saxon still allows Java extension functions → loaded stylesheet can run OS commands as the GeoNetwork process. Chain: unauthenticated POST plants the stylesheet → public-record GET triggers it. Affected: 4.4.x ≤ 4.4.11, 4.2.x ≤ 4.2.16, from 4.0.6. Fixed: 4.4.12 / 4.2.17. Trust boundary: anonymous HTTP → formatter store → Saxon → OS command. 121 internet-exposed 4.x instances across 39 countries; 89% gov/military/national-agency. Exposure scan, not confirmed compromise.
Post summary
The post discloses two pre‑authentication RCE vulnerabilities in GeoNetwork, outlines the exploit chain, and notes that fixes have been released for the affected versions.
@castilho101 breaks down the discovery and exploitation of a Pre-Auth Remote Code Execution flaw in GeoNetwork. We recently disclosed 4 CVEs on it: CVE-2026-63219 - Unauthenticated file upload via missing Authorization on formatter Upload Endpoint CVE-2026-55864 - Unauthenticated Server-Side Request Forgery in SLD Tool CVE-2026-57582 - Reflected XSS via unsanitized Javascript Sink CVE-2026-58400 - Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter Full writeup 👇
Post summary
The tweet discloses four CVEs in GeoNetwork with explicit technical vulnerability descriptions, including unauthenticated file upload, SSRF, XSS, and RCE flaws. No patches, exploits, or exploitation evidence are mentioned, aligning it with a pure vulnerability disclosure.
The GeoNetwork Pre-Auth RCE chain is two steps. Step 1: Upload a malicious XSLT via an endpoint missing PreAuthorize (CVE-2026-63219). Step 2: Saxon-B runs it with ALLOW_EXTERNAL_FUNCTIONS=true (CVE-2026-58400), leading to a direct call to java.lang.Runtime. https://t.co/zwTp3nY4sJ
Post summary
The tweet outlines a two‑step GeoNetwork exploitation chain, detailing how a missing PreAuthorize check (CVE‑2026‑63219) and Saxon‑B’s external function setting (CVE‑2026‑58400) combine to allow remote code execution via java.lang.Runtime. This description provides clear technical vulnerability details but no PoC, patch, or evidence of active exploitation.
🔴 GeoNetwork'te iki kritik güvenlik açığı birleştirilerek kimlik doğrulama gerektirmeyen RCE elde edilebiliyor. CVE-2026-63219 — 8.6 Yetkisiz dosya yükleme açığı CVE-2026-58400 — 9.1 Saxon XSLT yapılandırmasındaki güvenlik açığı Saldırgan, kimlik doğrulaması olmadan kötü amaçlı XSLT yükleyip bunu tetikleyerek sunucuda GeoNetwork kullanıcısının yetkileriyle işletim sistemi komutları çalıştırabiliyor. GeoNetwork 4.2.17 ve 4.4.12 sürümlerinde bu açıklar giderildi. PoC şu an public olarak erişilebilir durumda.
Post summary
Two critical CVEs in GeoNetwork enable unauthenticated RCE via malicious XSLT; PoC publicly available and patches exist for affected versions.
What happens when a single missing annotation leaves critical GeoNetwork infrastructure exposed across 39 countries? CVE-2026-63219. CVE-2026-55864. CVE-2026-57582. CVE-2026-58400. 89% of affected GeoNetwork deployments belong to government, military, or national agencies. Every single one was notified and patched before public disclosure. Read the full research⬇️ https://ethiack.com/info-hub/research/geonetwork-preauth-RCE
Post summary
Four new CVEs affecting GeoNetwork infrastructure are disclosed, with 89% of affected deployments in government or military sectors, all of which were patched before public disclosure.
🚨 CRITICAL: GeoNetwork flaws enable unauthenticated RCE Two vulnerabilities in the open-source geospatial metadata platform can be chained to achieve remote code execution: 🔴 CVE-2026-63219 — CVSS 8.6 Unauthenticated attackers can upload malicious XSL/XSLT formatter files. 🔴 CVE-2026-58400 — CVSS 9.1 Unsafe Saxon XSLT configuration allows uploaded stylesheets to execute OS commands. Together, an attacker can upload a malicious formatter and trigger it through a public record — no authentication required. Researchers identified 121 exposed vulnerable deployments across 39 countries, with 89% reportedly linked to government, military, or national agencies. Fixed in: ✅ GeoNetwork 4.4.12 ✅ GeoNetwork 4.2.17 #Cybersecurity #InfoSec #RCE #Geospatial #CVE #GovTech
Post summary
The tweet announces two critical remote code execution vulnerabilities in GeoNetwork, detailing the attack chain, CVSS scores, identified exposed deployments, and the CVE patches.
🚨 One missing authorisation check can become a remote shell. Researchers disclosed a GeoNetwork chain combining CVE-2026-63219, an unauthenticated formatter-upload flaw, with CVE-2026-58400, unsafe Saxon XSLT processing. An attacker can upload a malicious stylesheet and trigger it through a public metadata record to achieve pre-authentication remote code execution. ⚠️ GeoNetwork commonly supports government and agency geospatial portals. ⚠️ Researchers demonstrated the chain against GeoNetwork 4.4.11. ⚠️ Fixes shipped in versions 4.4.12 and 4.2.17. Security teams should: ✅ Upgrade affected installations immediately. ✅ Restrict formatter-management endpoints. ✅ Review newly created or modified XSLT formatters. ✅ Hunt for unauthenticated uploads and triggering requests. ✅ Rotate secrets and isolate systems showing suspicious execution. 🚀 Join Cert‑IX Early Access: https://cert-ix.com/early-access 🔎 Read the complete analysis: https://blog.cert-ix.com/articles/geonetwork-vulnerabilities-uncovering-rce-risks-in-government-portals-mtjxevrs #CertIX #GeoNetwork #RCE #CVE202663219 #CVE202658400 #ApplicationSecurity #GovernmentSecurity #CyberExposureManagement #CTEM
Post summary
Researchers have disclosed a chained RCE vulnerability in GeoNetwork, detailing the technical flaws and patch versions, and urging immediate upgrades and mitigation steps.