Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-01 | 2 | Disclosure2 |
| 2026-09-02 | 3 | Disclosure1Exploit1PoC1 |
| 2026-09-03 | 2 | Disclosure2 |
| 2026-09-04 | 1 | Patch1 |
| 2026-10-01 | 1 | Disclosure1 |
New unauth RCE in GeoNetwork Popped and reported by @castilho101 💥 CVE-2026-63219, CVE-2026-55864, CVE-2026-57582, CVE-2026-58400 https://t.co/aXkS1L27vw
Post summary
Four new unauthenticated RCE vulnerabilities in GeoNetwork have been disclosed. They carry the CVE numbers CVE-2026-63219, CVE-2026-55864, CVE-2026-57582, and CVE-2026-58400.
GeoNetwork pre-auth RCE chain: missing auth on formatter upload + unsafe Saxon XSLT. CVE-2026-63219 (8.6): formatter upload dropped Spring PreAuthorize after the 4.0.6 refactor → unauthenticated write of .xsl/.zip. CVE-2026-58400 (9.1): Saxon still allows Java extension functions → loaded stylesheet can run OS commands as the GeoNetwork process. Chain: unauthenticated POST plants the stylesheet → public-record GET triggers it. Affected: 4.4.x ≤ 4.4.11, 4.2.x ≤ 4.2.16, from 4.0.6. Fixed: 4.4.12 / 4.2.17. Trust boundary: anonymous HTTP → formatter store → Saxon → OS command. 121 internet-exposed 4.x instances across 39 countries; 89% gov/military/national-agency. Exposure scan, not confirmed compromise.
Post summary
The post discloses two pre‑auth Remote Code Execution weaknesses in GeoNetwork, details the attack chain and affected versions, and provides the fixes.
@castilho101 breaks down the discovery and exploitation of a Pre-Auth Remote Code Execution flaw in GeoNetwork. We recently disclosed 4 CVEs on it: CVE-2026-63219 - Unauthenticated file upload via missing Authorization on formatter Upload Endpoint CVE-2026-55864 - Unauthenticated Server-Side Request Forgery in SLD Tool CVE-2026-57582 - Reflected XSS via unsanitized Javascript Sink CVE-2026-58400 - Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter Full writeup 👇
Post summary
The tweet announces the recent disclosure of four CVEs affecting GeoNetwork, providing technical descriptions of each vulnerability including a pre‑auth RCE, file upload flaw, SSRF, and XSS, and directs readers to a full writeup.
The GeoNetwork Pre-Auth RCE chain is two steps. Step 1: Upload a malicious XSLT via an endpoint missing PreAuthorize (CVE-2026-63219). Step 2: Saxon-B runs it with ALLOW_EXTERNAL_FUNCTIONS=true (CVE-2026-58400), leading to a direct call to java.lang.Runtime. https://t.co/zwTp3nY4sJ
Post summary
The tweet highlights a two‑step remote code execution chain in GeoNetwork, detailing how a malicious XSLT upload combined with an insecure Saxon configuration can invoke java.lang.Runtime.
🔴 GeoNetwork'te iki kritik güvenlik açığı birleştirilerek kimlik doğrulama gerektirmeyen RCE elde edilebiliyor. CVE-2026-63219 — 8.6 Yetkisiz dosya yükleme açığı CVE-2026-58400 — 9.1 Saxon XSLT yapılandırmasındaki güvenlik açığı Saldırgan, kimlik doğrulaması olmadan kötü amaçlı XSLT yükleyip bunu tetikleyerek sunucuda GeoNetwork kullanıcısının yetkileriyle işletim sistemi komutları çalıştırabiliyor. GeoNetwork 4.2.17 ve 4.4.12 sürümlerinde bu açıklar giderildi. PoC şu an public olarak erişilebilir durumda.
Post summary
The post discloses two GeoNetwork RCE vulnerabilities that can be leveraged without authentication, notes a publicly available PoC, and indicates that patches are available in versions 4.2.17 and 4.4.12.
What happens when a single missing annotation leaves critical GeoNetwork infrastructure exposed across 39 countries? CVE-2026-63219. CVE-2026-55864. CVE-2026-57582. CVE-2026-58400. 89% of affected GeoNetwork deployments belong to government, military, or national agencies. Every single one was notified and patched before public disclosure. Read the full research⬇️ https://ethiack.com/info-hub/research/geonetwork-preauth-RCE
Post summary
The post announces four CVEs affecting GeoNetwork that expose infrastructure due to a missing annotation, with all affected deployments patched prior to public disclosure.
🚨 CRITICAL: GeoNetwork flaws enable unauthenticated RCE Two vulnerabilities in the open-source geospatial metadata platform can be chained to achieve remote code execution: 🔴 CVE-2026-63219 — CVSS 8.6 Unauthenticated attackers can upload malicious XSL/XSLT formatter files. 🔴 CVE-2026-58400 — CVSS 9.1 Unsafe Saxon XSLT configuration allows uploaded stylesheets to execute OS commands. Together, an attacker can upload a malicious formatter and trigger it through a public record — no authentication required. Researchers identified 121 exposed vulnerable deployments across 39 countries, with 89% reportedly linked to government, military, or national agencies. Fixed in: ✅ GeoNetwork 4.4.12 ✅ GeoNetwork 4.2.17 #Cybersecurity #InfoSec #RCE #Geospatial #CVE #GovTech
Post summary
The post announces two CVEs in GeoNetwork that allow unauthenticated remote code execution through malicious XSL/T uploads, reports widespread exposure, and provides the specific patches to mitigate the risk.
🚨 One missing authorisation check can become a remote shell. Researchers disclosed a GeoNetwork chain combining CVE-2026-63219, an unauthenticated formatter-upload flaw, with CVE-2026-58400, unsafe Saxon XSLT processing. An attacker can upload a malicious stylesheet and trigger it through a public metadata record to achieve pre-authentication remote code execution. ⚠️ GeoNetwork commonly supports government and agency geospatial portals. ⚠️ Researchers demonstrated the chain against GeoNetwork 4.4.11. ⚠️ Fixes shipped in versions 4.4.12 and 4.2.17. Security teams should: ✅ Upgrade affected installations immediately. ✅ Restrict formatter-management endpoints. ✅ Review newly created or modified XSLT formatters. ✅ Hunt for unauthenticated uploads and triggering requests. ✅ Rotate secrets and isolate systems showing suspicious execution. 🚀 Join Cert‑IX Early Access: https://cert-ix.com/early-access 🔎 Read the complete analysis: https://blog.cert-ix.com/articles/geonetwork-vulnerabilities-uncovering-rce-risks-in-government-portals-mtjxevrs #CertIX #GeoNetwork #RCE #CVE202663219 #CVE202658400 #ApplicationSecurity #GovernmentSecurity #CyberExposureManagement #CTEM
Post summary
Researchers disclosed a chain of CVEs leading to pre‑authentication remote code execution in GeoNetwork, with fixes available in newer releases and recommendations for immediate upgrades and hardening measures.
Warning: High Missing Authorization flaw in #GeoNetwork. CVE-2026-63219 CVSS: 8.6. This can lead to unauthorized formatter-file uploads, and possible remote code execution! #Patch #Patch #Patch
Post summary
The tweet warns of a missing authorization flaw (CVE-2026-63219) in GeoNetwork that could enable unauthorized file uploads and possible remote code execution, urging users to address it.