CVE-2026-63219: 
Java vulnerability analysis and mitigation

CVE-2026-63219 is a missing authorization vulnerability in GeoNetwork, an open-source catalog application for managing spatially referenced resources. The API endpoint for creating a new formatter via file upload is completely unprotected, allowing unauthenticated attackers to upload arbitrary .xsl or .zip formatter files to the server. Affected versions include all 4.4.x releases up to and including 4.4.11, and all 4.2.x releases up to and including 4.2.16. The vulnerability was reported by researchers at Ethiack, fixed in GeoNetwork versions 4.4.12 and 4.2.17 on July 8, 2026, and publicly disclosed on August 31, 2026. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, The Hacker News).

The root cause is CWE-862 (Missing Authorization): the formatter upload API endpoint (/geonetwork/srv/api/formatters) lacks any authentication or authorization check, a regression introduced when the endpoint was refactored in version 4.0.6 (GitHub Advisory, The Hacker News). An attacker can send an unauthenticated HTTP POST request to this endpoint to write arbitrary .xsl or .zip files into the GeoNetwork formatter directory. This vulnerability is particularly dangerous when chained with CVE-2026-58400 (CVSS 9.1), an unsafe XSLT processor configuration in the Saxon engine that allows uploaded stylesheets to invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder, achieving unauthenticated remote code execution. The fix, implemented in pull request #9346, enforces consistent access control on the formatter admin API (GitHub PR).

On its own, CVE-2026-63219 enables unauthorized write access to server storage, allowing any unauthenticated network attacker to plant arbitrary files in the GeoNetwork formatter directory without any credentials. When chained with CVE-2026-58400, the impact escalates to full unauthenticated remote code execution as the GeoNetwork process user, enabling data exfiltration, lateral movement, and complete server compromise. Ethiack identified 121 internet-exposed GeoNetwork deployments running affected versions across 39 countries, with approximately 89% being government-, military-, or national-agency-related systems — including backends for the European INSPIRE geoportal and other Spatial Data Infrastructure deployments (The Hacker News, GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no confirmed evidence of in-the-wild exploitation as of the disclosure date (The Hacker News). The vulnerability is rated as automatable (no user interaction required, low attack complexity, no privileges required), making it highly amenable to mass scanning and exploitation. The EPSS score is currently 0.0, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog as of disclosure. The vulnerability was credited to researchers Rafael Castilho and Ethiack, who also published a technical write-up (Ethiack Research, GitHub Advisory).

1. Reconnaissance: Identify internet-exposed GeoNetwork instances using tools like Shodan or Censys, targeting versions 4.0.6 through 4.4.11 or below 4.2.17. GeoNetwork is commonly deployed as a geoportal backend for government and agency infrastructure.
2. Confirm vulnerability: Send a test HTTP GET request to /geonetwork/srv/api/formatters to confirm the endpoint is accessible and the instance is running a vulnerable version.
3. Craft malicious XSL formatter: Create a malicious .xsl stylesheet that invokes java.lang.Runtime.exec() or java.lang.ProcessBuilder to execute OS commands (exploiting CVE-2026-58400 in the Saxon XSLT processor).
4. Upload malicious formatter: Send an unauthenticated HTTP POST request to /geonetwork/srv/api/formatters with the malicious .xsl or .zip file as the payload. No authentication token or session cookie is required.
5. Trigger XSLT execution: Send a GET request to a public metadata record endpoint that references the uploaded formatter, causing the Saxon engine to load and execute the malicious stylesheet.
6. Achieve RCE: The Saxon engine executes the embedded OS commands as the GeoNetwork process user, enabling reverse shell establishment, data exfiltration, or further lateral movement within the network (The Hacker News, Ethiack Research).

• Network: Unauthenticated HTTP POST requests to /geonetwork/srv/api/formatters from external IP addresses; unusual outbound connections from the GeoNetwork server to unknown external hosts following formatter upload activity.
• File System: Unexpected or newly created .xsl or .zip files in the GeoNetwork formatter directory that were not placed by an administrator; files with obfuscated names or containing Java extension function calls (java.lang.Runtime, java.lang.ProcessBuilder).
• Logs: GeoNetwork access logs showing POST requests to /geonetwork/srv/api/formatters without an authenticated session; subsequent GET requests to metadata record endpoints referencing newly uploaded formatters from the same or related IP addresses.
• Process: Unusual child processes spawned by the GeoNetwork Java process (e.g., /bin/bash, cmd.exe, curl, wget, python); unexpected network connections initiated by the Java process.

Upgrade to GeoNetwork 4.4.12 or 4.2.17, which enforce proper authorization on the formatter upload endpoint (GitHub Advisory). For systems that cannot be immediately patched, block write methods (POST, PUT, PATCH) to the /geonetwork/srv/api/formatters endpoint at the reverse proxy layer using the following rules:

• Apache httpd: Add Require all denied within a <Location /geonetwork/srv/api/formatters> block scoped to non-GET methods.
• Nginx: Use limit_except GET HEAD OPTIONS { deny all; } for the /geonetwork/srv/api/formatters location.

Note that these workarounds will also prevent authenticated administrators from uploading formatters via the API until the application is patched. Applying both the patch for CVE-2026-63219 and addressing CVE-2026-58400 is necessary to fully eliminate the unauthenticated RCE chain (GitHub Advisory, The Hacker News).

The Hacker News covered the disclosure prominently, highlighting the government and agency exposure risk and drawing parallels to prior geospatial stack vulnerabilities such as CVE-2024-36401 (GeoServer, exploited by botnets and the SideWalk backdoor) (The Hacker News). The Centre for Cybersecurity Belgium (CCB) issued a warning advisory urging immediate patching (CCB Advisory). Ethiack, the discovering vendor, published a detailed research write-up and noted that 89% of the 121 fingerprinted vulnerable instances were government or military-related, amplifying concern about critical infrastructure exposure (Ethiack Research). CyberWorldOps and other security outlets also covered the two-flaw RCE chain, and the disclosure generated notable discussion on LinkedIn and Bluesky.