GeoNetwork servers that power government data portals are exposed to a two-step attack that ends in remote code execution without any login. The open-source project published details on August 31 and says fixes have been available since July 8.
The chain starts with CVE-2026-63219, a missing authorization check on the formatter upload endpoint that lets anonymous users plant arbitrary .xsl or .zip files on the server. A second bug, CVE-2026-58400, leaves the Saxon XSLT processor able to load those stylesheets and execute operating-system commands as the GeoNetwork process user. Requesting any public record after the upload triggers the engine, and the pair carries CVSS scores of 8.6 and 9.1.
Security firm Ethiack, whose researcher Rafael Castilho reported the flaws, says the formatter endpoint lost its authorization check in version 4.0.6, so every release up to 4.4.11 and 4.2.16 is affected. Patches landed in versions 4.4.12 and 4.2.17. Ethiack counted 121 internet-exposed deployments across 39 countries, 89 percent of them tied to government, military, or national agencies, though it reported no confirmed compromises.
GeoNetwork grew out of the United Nations Food and Agriculture Organization and sits behind the European INSPIRE geoportal. Until upgrades happen, administrators can deny POST, PUT, and PATCH requests to the formatter endpoint at the reverse proxy. No exploitation in the wild has been reported, and the flaws are not in CISA’s Known Exploited Vulnerabilities catalog.
