Critical Vulnerability in GeoNetwork Puts Government Portals at Risk
Two flaws in the open-source geospatial system allow remote code execution on government backend systems.
1Critical Vulnerabilities in GeoNetwork
Two vulnerabilities in the open-source geospatial metadata catalog GeoNetwork allow unauthenticated remote code execution (RCE). These flaws affect systems behind many government and agency geoportals. The issues were fixed in versions 4.4.12 and 4.2.17 on July 8, 2026, but details were published on August 31. GeoNetwork originated at the UN Food and Agriculture Organization and is now maintained by the Open Source Geospatial Foundation (OSGeo).
2Technical Details of the Flaws
The first vulnerability (CVE-2026-63219, CVSS score: 8.6) stems from a missing authorization check on the formatter upload endpoint, allowing unauthenticated users to upload .xsl or .zip files. The second flaw (CVE-2026-58400, CVSS score: 9.1) involves unsafe configuration of the Saxon XSLT processor, enabling loaded stylesheets to execute OS commands. Normally the second flaw requires privileges, but chaining it with the first removes this requirement.
3Attack Scenario
An attacker first uploads a malicious formatter through the unprotected endpoint. A subsequent GET request to a public record triggers the Saxon engine to execute the stylesheet, leading to code execution. Security firm Ethiack reports this chain works starting from version 4.0.6 when the formatter endpoint was refactored. Researcher Rafael Castilho discovered these flaws that became exploitable after authorization checks were accidentally removed.
4Affected Systems
Ethiack fingerprinted 121 internet-exposed GeoNetwork deployments running vulnerable versions across 39 countries, with 89% being government, military, or national agency systems. All 4.4.x releases up to 4.4.11 and all 4.2.x releases up to 4.2.16 are affected. The flaws are fixed in 4.4.12 and 4.2.17. GeoNetwork strongly recommends all users upgrade immediately.
5Interim Mitigations
Until updating, administrators can block write methods (PUT, POST, DELETE) to the formatter endpoint at the reverse proxy. This will prevent both attacks and legitimate admin console uploads. The advisory provides specific rules to restrict these HTTP methods temporarily while awaiting full patching.
6Security Issues in Geospatial Stack
These flaws follow a series of security issues across geospatial systems. Last year, a critical GeoServer flaw (CVE-2024-36401, CVSS 9.8) was exploited for botnets, crypto miners, and the SideWalk backdoor. Another GeoServer XXE flaw (CVE-2025-58360) was added to CISA's KEV catalog in December 2025 after active exploitation. Last month, a separate GeoServer SQLi-to-RCE zero-day came under active probing shortly after disclosure.
7Potential Impacts
As a core component of many Spatial Data Infrastructure deployments including Europe's INSPIRE geoportal, GeoNetwork compromises could lead to unauthorized access and manipulation of sensitive geospatial data. Government and military systems being affected poses serious national security risks. The absence from CISA's Known Exploited Vulnerabilities catalog suggests no active exploitation yet.
8AI and Vulnerability Chaining
AI technologies can now discover and chain vulnerabilities within minutes, making it crucial for security teams to strengthen visibility, response, and remediation capabilities. Organizations must identify exploitable risks faster, prioritize critical issues, and reduce exposure before AI-powered attacks accelerate threats. The GeoNetwork flaws underscore the need for continuous security reviews in critical infrastructure systems.