Summary
- GeoNetwork has disclosed a missing-authorisation flaw and an XSLT processing weakness that can be chained for unauthenticated code execution.
- Fixed versions 4.4.12 and 4.2.17 were released in July before full vulnerability details were published.
- Ethiack reports 121 exposed affected deployments across 39 countries, but exposure does not establish that any system was compromised.
Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution on affected geospatial catalogue servers, creating a potentially serious exposure for software widely associated with government and public-sector geoportals.
The open-source project published security advisories for the flaws at the end of August, after fixes had already been released in GeoNetwork 4.4.12 and 4.2.17 in July.
The first weakness, CVE-2026-63219, is a missing authorisation check on a formatter upload endpoint. It can allow an unauthenticated user to upload formatter files to an affected server. The second, CVE-2026-58400, involves the Saxon XSLT processing configuration and can permit operating-system command execution when a malicious stylesheet is processed by a sufficiently privileged formatter context.
Individually, the vulnerabilities have different prerequisites and impacts. Chained together, the unauthorised upload can provide the input needed to reach the code-execution condition without the attacker first holding an authenticated account.
That interaction is more consequential than either CVE considered in isolation. Vulnerability-management programmes frequently prioritise individual entries according to severity and exposure, but exploit chains can remove assumptions built into the scoring of one component. In this case, the upload weakness can effectively provide the content-placement condition needed for the second flaw.
The security company Ethiack, whose researcher Rafael Castilho is credited with finding the issues, has said it fingerprinted 121 internet-facing GeoNetwork deployments running affected versions across 39 countries. It estimates that 89% were associated with government, military, or national-agency environments.
Those figures require careful qualification. They describe systems that researchers identified as exposed and apparently running affected software versions; they are not a count of compromised organisations. No public evidence currently establishes that the disclosed chain has been used maliciously against those systems.
The public-sector concentration nevertheless changes the risk calculation. GeoNetwork is used to catalogue, publish, and search geospatial metadata, placing it within a class of infrastructure that can sit behind national, regional, scientific, environmental, and other government data services.
An internet-facing catalogue may be intentionally public because publishing searchable metadata is the purpose of the service. That means reducing exposure is not always as straightforward as moving the application behind an internal network. Operators instead depend heavily on application-level authorisation, secure processing, reverse-proxy controls, and timely updates.
The disclosure also demonstrates the value of coordinated remediation before detailed exploit information is released. Fixed GeoNetwork versions were available weeks before the full technical advisories became public, giving operators an opportunity to update without a widely documented exploit chain circulating at the same time.
That window is only useful where asset owners know which versions they are running and can deploy updates promptly. Public-sector software estates often combine open-source components, bespoke integrations, long-lived systems, and externally managed infrastructure, making inventory and maintenance ownership as important as the availability of a patch.
GeoNetwork’s own security policy recommends moving to the latest supported incremental release. For the newly disclosed chain, versions 4.4.12 and 4.2.17 contain the relevant fixes. The outstanding question is therefore less about whether a remedy exists than how many exposed installations were updated before the technical details became broadly available.
