GeoNetwork Fixes Vulnerability Chain Enabling Remote Command Execution

GeoNetwork vulnerability fixes are available in versions 4.4.12 and 4.2.17. On August 31, 2026, the project published security advisories for a chain of flaws that, if successfully exploited, could allow remote command execution with the privileges of the GeoNetwork process. One of the flaws, CVE-2026-58400, has a CVSS rating of 9.1.

Fixed releases 4.4.12 and 4.2.17 were published on July 8, 2026. Operators should therefore verify the product branch in use and update to the corresponding fixed version.

GeoNetwork vulnerability fixes address Saxon XSLT processing

According to the CVE-2026-58400 security advisory, GeoNetwork processes can execute arbitrary commands if an attacker can upload a formatter stylesheet. The flaw is related to the configuration of the Saxon XSLT processor.

The RCE flaw itself requires the ability to upload a formatter stylesheet. However, the project also published an advisory concerning unauthenticated formatter uploads. Chaining these two issues could eliminate the need for prior privileges that would otherwise be required to exploit the XSLT flaw.

Unpatched publicly accessible instances could allow remote command execution in the context of the GeoNetwork process if both steps are successfully combined. However, the extent of actually exposed and unupdated deployments is not known.

What administrators should do

• Verify the version of the deployed GeoNetwork instance.
• Update the 4.4 branch to version 4.4.12 or the 4.2 branch to version 4.2.17.
• Check whether the instance is publicly accessible and allows formatter uploads.
• Monitor for any additional project guidance on restricting formatter uploads and checking for compromise.

GeoNetwork serves as a catalog of geospatial metadata and is used in spatial data infrastructure initiatives. The combination of anonymous uploads and unsafe XSLT processing increases the urgency of updating.

Active exploitation has not been confirmed

Active exploitation of CVE-2026-58400 or the compromise of a specific organization has not been confirmed. The extent of actually exposed and unpatched deployments has also not been independently confirmed.

Further developments will primarily be indicated by any information about exploitation attempts, inclusion of the flaw in catalogs of actively exploited vulnerabilities, and statements from operators of public GeoNetwork portals regarding completed updates.

Verified and updated: 09/02/2026 12:05