Affected Systems

GeoNetwork open-source geospatial metadata catalog: all 4.4.x versions up to 4.4.11 and all 4.2.x versions up to 4.2.16. Widely deployed in government, military, and national agency Spatial Data Infrastructure backends across 39 countries, including European INSPIRE geoportal.

Exploitation Status

No public evidence of active exploitation as of disclosure (September 2, 2026). Not listed in CISA KEV catalog. Fixes released July 8, 2026; details published August 31, 2026. Ethiack fingerprinted 121 internet-exposed vulnerable instances (89% government/military/agency), but these are exposure counts, not confirmed compromises.

Business Impact

Unauthenticated remote code execution on GeoNetwork backends enables full server compromise as the GeoNetwork process user. Chain combines CVE-2026-63219 (CVSS 8.6, missing authorization on formatter upload) with CVE-2026-58400 (CVSS 9.1, unsafe Saxon XSLT processor allowing Java Runtime.exec()). Attacker uploads malicious .xsl formatter via unprotected endpoint, then triggers execution via public GET request. High-value targets: government geoportals managing spatial data infrastructure. Eight-week patch window before disclosure reduces immediate risk, but unpatched instances remain vulnerable.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Upgrade GeoNetwork to version 4.4.12 (for 4.4.x branch) or 4.2.17 (for 4.2.x branch) immediately.
  • Until patched, block POST, PUT, and PATCH requests to /geonetwork/srv/api/formatters at reverse proxy (Apache httpd or Nginx) to prevent unauthorized formatter uploads.
  • Audit GeoNetwork access logs for suspicious POST requests to /srv/api/formatters and unexpected GET requests triggering formatter execution between version 4.0.6 and patch deployment.
  • Inventory all GeoNetwork instances in your environment, prioritize internet-facing deployments, and verify patch status.
  • Review filesystem for unauthorized .xsl or .zip files in the GeoNetwork formatter directory and inspect for malicious XSLT code calling Java Runtime or ProcessBuilder.