---
schema: 1
kind: vulnerability
title: "CVE-2026-63219 / CVE-2026-58400 — GeoNetwork opensource: chained unauthenticated formatter upload plus unsafe Saxon XSLT processing reaches unauthenticated RCE (CVSS 8.6 / 9.1)"
headline: "Two GeoNetwork flaws chain into unauthenticated remote code execution on government geodata catalog backends"
summary: >
  GeoNetwork opensource, the catalog application behind government geodata portals including the
  European INSPIRE geoportal, fixed two chainable flaws in 4.4.12 and 4.2.17: an unauthenticated
  formatter-upload endpoint (CVE-2026-63219) and an unsafely configured XSLT processor (CVE-2026-58400)
  that together let an unauthenticated attacker reach remote code execution. A researcher published a
  working proof-of-concept; no confirmed in-the-wild exploitation is established.
discovered_at: "2026-09-05T04:35:00Z"
updated_at: null
event_date: "2026-08-31"
run_id: 2026-09-05T0409Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, poc-public, patch-available]
regions: [global, europe, switzerland]
sectors: [public-sector]
entities: []
techniques: [T1190, T1059]
affected_products: ["GeoNetwork opensource"]
cves:
  - id: CVE-2026-63219
    cvss: "8.6"
    epss: "0.0047"
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [poc-public, patch-available]
    affected: "≤ 4.4.11 / ≤ 4.2.16"
    fixed: "4.4.12 / 4.2.17"
  - id: CVE-2026-58400
    cvss: "9.1"
    epss: "0.0119"
    type: rce
    vector: zero-click
    auth: admin-required
    status: [poc-public, patch-available]
    affected: "≤ 4.4.11 / ≤ 4.2.16"
    fixed: "4.4.12 / 4.2.17"
sources:
  - url: "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42"
    publisher: "GeoNetwork (GitHub Security Advisory)"
    date: "2026-08-31"
    role: primary
  - url: "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r"
    publisher: "GeoNetwork (GitHub Security Advisory)"
    date: "2026-08-31"
    role: primary
  - url: "https://ethiack.com/info-hub/research/geonetwork-preauth-RCE"
    publisher: "Ethiack (Rafael Castilho)"
    date: "2026-08-31"
    role: primary
  - url: "https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html"
    publisher: "The Hacker News"
    date: "2026-09-02"
    role: corroborating
  - url: "https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.12"
    publisher: "GeoNetwork GitHub Releases"
    date: "2026-07-08"
    role: corroborating
  - url: "https://api.first.org/data/v1/epss?cve=CVE-2026-63219,CVE-2026-58400"
    publisher: "FIRST.org EPSS API"
    date: "2026-09-04"
    role: corroborating
  - url: "https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-70647"
    publisher: "ENISA EU Vulnerability Database"
    date: "2026-09-02"
    role: corroborating
closed_sources: []
evidence:
  - quote: "An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server."
    publisher: "GeoNetwork (GitHub Security Advisory)"
  - quote: "Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary"
    publisher: "GeoNetwork (GitHub Security Advisory)"
  - quote: "As you may expect, we can chain the Unauthorised Upload vulnerability with the unsafe XSLT processing vulnerability and get unauthenticated Remote Code Execution."
    publisher: "Ethiack (Rafael Castilho)"
verification: multi-source
sourcing_note: >
  ENISA's EU Vulnerability Database lists the upload flaw (CVE-2026-63219 / EUVD-2026-70647) on its
  exploited feed with an exploitedSince date of 2026-09-02 — a claim no other source corroborates and
  that contradicts CISA's own ADP Vulnrichment SSVC assessment of "none" on CVE-2026-63219 itself (as
  of 2026-09-03), which also assessed the chained companion CVE-2026-58400 as "none". A comparable
  EUVD/vendor mismatch occurred on CVE-2026-69836 in August 2026,
  where the vendor's own record was the accurate account; `status` below does not carry `exploited`
  pending independent corroboration. EPSS scores (FIRST.org, 2026-09-04) are 0.0047 for
  CVE-2026-63219 and 0.0119 for CVE-2026-58400 — both low, a metric distinct from the disputed
  exploited flag above.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Patch every internet-facing GeoNetwork instance to ≥ 4.4.12 / ≥ 4.2.17 now; where immediate patching is not possible, block POST/PUT/PATCH to `/geonetwork/srv/api/formatters` at the reverse proxy (this also disables the legitimate formatter-management admin UI, which shares the same endpoint)."
updates: []
migrated_from: null
---

GeoNetwork opensource, the open-source geospatial metadata catalog application deployed behind government open-data portals, environmental agencies and national geoportals — the European INSPIRE geoportal is named as a deployment ([The Hacker News, 2026-09-02](https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html)) — carried two flaws that chain into unauthenticated remote code execution. CVE-2026-63219 (CVSS 8.6) is a missing-authorization defect on the formatter-creation API (`POST /geonetwork/srv/api/formatters`): the endpoint's admin-only access check was present and effective in GeoNetwork versions before 4.0.6, but was dropped during a refactor of the endpoint in 4.0.6 and never restored, so any unauthenticated caller can upload arbitrary `.xsl` or `.zip` "formatter" files straight into the server's formatter directory ([GeoNetwork Security Advisory, 2026-08-31](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-mh22-prqr-vf42); [Ethiack, 2026-08-31](https://ethiack.com/info-hub/research/geonetwork-preauth-RCE)). CVE-2026-58400 (CVSS 9.1) is a second flaw in how GeoNetwork configures its Saxon XSLT processor: the engine runs without secure processing enabled and without disabling external functions, so any stylesheet GeoNetwork loads can invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly ([GeoNetwork Security Advisory, 2026-08-31](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-x898-729x-cc3r)). Chained, an attacker uploads a malicious `.xsl` formatter through the unauthenticated endpoint, then triggers it with an unauthenticated GET against any public record — the formatter name is already known to the attacker from the upload step, and a public record identifier is trivially discoverable through GeoNetwork's own search API — reaching code execution as the GeoNetwork process user ([Ethiack, 2026-08-31](https://ethiack.com/info-hub/research/geonetwork-preauth-RCE)). Researcher Rafael Castilho published a reverse-shell proof-of-concept against GeoNetwork 4.4.11. The vendor's own advisory and MITRE's CNA record both track the affected range as every 4.3.x/4.4.x release up to 4.4.11 plus every 4.2.x release up to 4.2.16, both fixed in 4.4.12 and 4.2.17 released 2026-07-08 ([GeoNetwork GitHub Releases, 4.4.12](https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.12)); Ethiack's independent research states the missing-authorization defect itself was introduced earlier, in the 4.0.6 refactor, so any deployment running an unsupported 4.0.6–4.2.x-line release the vendor advisory does not enumerate should not assume it is unaffected. No source — the vendor's own advisories, the discovering researcher, or The Hacker News — reports confirmed in-the-wild exploitation of either flaw. Ethiack's own internet-wide scan identified 121 affected GeoNetwork 4.x deployments across 39 countries or regions, 89% of them government, military or national-agency related, with Europe and EU/international-facing deployments accounting for 77.7% of the dataset ([Ethiack, 2026-08-31](https://ethiack.com/info-hub/research/geonetwork-preauth-RCE)).

**Detection:** web-server or reverse-proxy access logs for POST requests to `/geonetwork/srv/api/formatters` from unauthenticated sessions — any hit is anomalous — followed by a GET to the record-view endpoint referencing a newly created formatter name; process-creation telemetry on the GeoNetwork host for any child process spawned by the application server, which should never legitimately fork OS commands.

**Defender takeaway:** GeoNetwork and GeoNetwork-derived catalog software are common building blocks behind INSPIRE-compliant cantonal and federal geoportals in Europe; any Swiss public-sector geodata catalog service should be checked against this version range specifically, independent of whether exploitation is ever confirmed — the chain requires no authentication at any step.