GeoNetwork RCE vulnerability enables remote code execution

Affected Systems

GeoNetwork open-source catalog application. Specific affected versions not disclosed in advisory. All unpatched GeoNetwork instances potentially at risk.

Exploitation Status

Unknown - CERT.BE issued urgent patching advisory suggesting active threat, but no confirmation of active exploitation or public PoC availability provided in source material.

Business Impact

Critical RCE vulnerability allows attackers to execute arbitrary code remotely on GeoNetwork servers. Organizations using GeoNetwork for geospatial metadata management face risk of complete system compromise, data theft, lateral movement, and service disruption. No CVE assigned yet, limiting threat intelligence correlation. Severity assessment relies on CERT.BE critical rating and RCE classification.

Urgency

🔴 Immediate

Recommended Actions

• Identify all GeoNetwork instances in your environment immediately using asset inventory and network scanning
• Apply latest security patches from GeoNetwork project (https://geonetwork-opensource.org/) to all instances
• If patching cannot be completed immediately, isolate GeoNetwork systems from internet exposure using firewall rules or network segmentation
• Monitor GeoNetwork application logs and web server access logs for suspicious activity, unusual POST requests, or unexpected code execution attempts
• Review GeoNetwork user accounts and access permissions; disable unnecessary accounts and enforce strong authentication