CVE-2026-58400: 
Java vulnerability analysis and mitigation

CVE-2026-58400 is a critical Remote Code Execution (RCE) vulnerability in GeoNetwork, an open-source catalog application for managing spatially referenced resources. The flaw stems from the Saxon XSLT processor being configured without FEATURE_SECURE_PROCESSING and without disabling Java extension functions (ALLOW_EXTERNAL_FUNCTIONS), allowing any loaded stylesheet to invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder directly. Affected versions include all 4.4.x releases up to and including 4.4.11, and all 4.2.x releases up to and including 4.2.16. The vulnerability was patched on July 8, 2026, with advisory details published on August 31, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, The Hacker News).

The root cause is classified under CWE-94 (Improper Control of Generation of Code / Code Injection) and CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / Unsafe Reflection). The Saxon XSLT processor, used to render GeoNetwork formatters, lacks both FEATURE_SECURE_PROCESSING and the ALLOW_EXTERNAL_FUNCTIONS restriction, meaning any .xsl stylesheet it processes can directly call Java runtime methods to execute OS commands as the GeoNetwork process user. On its own, CVE-2026-58400 requires high privileges (formatter upload capability); however, it is chainable with CVE-2026-63219 (CVSS 8.6), a missing authorization check on the formatter upload endpoint that allows unauthenticated file uploads, effectively removing the privilege precondition. The attack chain was discovered by researchers at Ethiack, with the formatter endpoint vulnerability traceable to version 4.0.6 when an authorization check was inadvertently dropped during a refactor (GitHub Advisory, The Hacker News, Ethiack Research).

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the GeoNetwork process, resulting in full compromise of confidentiality, integrity, and availability of the affected server. When chained with CVE-2026-63219, the attack is reachable without any authentication, enabling unauthenticated attackers to achieve RCE on internet-exposed GeoNetwork instances. Ethiack identified 121 internet-exposed GeoNetwork deployments running affected versions across 39 countries, with approximately 89% linked to government, military, or national agency operations — including the backend of the European INSPIRE geoportal — making the potential impact to critical public infrastructure significant (The Hacker News, Ethiack Research).

As of disclosure, no public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the disclosure date. The EPSS score is reported at 0.0, reflecting low current exploitation probability. However, the attack chain (combined with CVE-2026-63219) is fully unauthenticated and low-complexity, and the high concentration of vulnerable government geoportals significantly raises the risk profile. No specific threat actor attribution has been reported (The Hacker News, Feedly).

1. Reconnaissance: Use tools like Shodan or Censys to identify internet-exposed GeoNetwork instances running versions 4.0.6 through 4.4.11 or below 4.2.17. Look for the /geonetwork/srv/api/formatters endpoint.
2. Exploit CVE-2026-63219 (unauthenticated upload): Send an unauthenticated HTTP POST or PUT request to the /geonetwork/srv/api/formatters endpoint, uploading a malicious .xsl file. This bypasses the missing authorization check (CVE-2026-63219).
3. Craft malicious XSLT payload: The uploaded .xsl file contains a Java extension call, for example:

<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
  xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime"
  version="1.0">
  <xsl:template match="/">
    <xsl:variable name="rtObj" select="rt:getRuntime()"/>
    <xsl:variable name="process" select="rt:exec($rtObj,'id')"/>
  </xsl:template>
</xsl:stylesheet>

4. Trigger stylesheet execution: Send a GET request to a public GeoNetwork metadata record using the uploaded formatter (e.g., /geonetwork/srv/api/records/{uuid}/formatters/{formatterName}), causing the Saxon XSLT engine to process the malicious stylesheet.
5. Achieve RCE: The Saxon processor, lacking FEATURE_SECURE_PROCESSING, executes the Java extension call, running arbitrary OS commands as the GeoNetwork process user — enabling reverse shell, data exfiltration, or further lateral movement (GitHub Advisory, The Hacker News, Ethiack Research).

• Network: Unexpected POST, PUT, or PATCH requests to /geonetwork/srv/api/formatters from unauthenticated or anonymous sources; outbound connections from the GeoNetwork server to unknown external IPs following formatter requests.
• File System: Presence of unexpected or newly created .xsl or .zip files in the GeoNetwork formatter directory; web shells or scripts written to the server filesystem by the GeoNetwork process user.
• Logs: GeoNetwork access logs showing unauthenticated uploads to the formatter endpoint; Saxon XSLT processing errors or Java class invocation traces in application logs; GET requests to formatter endpoints immediately following an unauthenticated upload.
• Process: Unusual child processes spawned by the GeoNetwork Java process (e.g., /bin/sh, bash, cmd.exe, curl, wget, python, nc); unexpected network connections initiated by the GeoNetwork JVM process (GitHub Advisory, The Hacker News).

GeoNetwork released patched versions 4.4.12 and 4.2.17 on July 8, 2026; all users are strongly encouraged to upgrade immediately. For administrators unable to patch immediately, the following reverse proxy rules can block the unauthenticated upload vector (CVE-2026-63219) that enables the unauthenticated RCE chain:

• Apache httpd: Deny POST, PUT, and PATCH requests to the /geonetwork/srv/api/formatters location.
• Nginx: Restrict the same location to GET, HEAD, and OPTIONS methods only. Note that these workarounds block legitimate formatter uploads via the admin console but prevent unauthenticated exploitation of the chain (GitHub Advisory, The Hacker News).

The GeoNetwork project (under OSGeo) published the advisory on August 31, 2026, approximately eight weeks after the fixes were shipped, and strongly urged all users to upgrade. The Hacker News covered the disclosure prominently, highlighting the concentration of vulnerable government and agency geoportals as a significant concern. Ethiack, the security vendor whose researchers (Rafael Castilho and others) discovered and reported the flaws, published a detailed research post and noted that 89% of the 121 fingerprinted exposed instances were government- or military-related. Community discussion was observed on LinkedIn, Mastodon, and Bluesky, with multiple security news aggregators and blogs amplifying the story (The Hacker News, Ethiack Research, CyberWorldOps).