GeoNetwork CVE-2026-58400, chained with CVE-2026-63219, allows unauthenticated remote code execution on the open-source geospatial metadata catalog that sits behind many government and agency geoportals. GeoNetwork originated at the UN Food and Agriculture Organization and is maintained under the Open Source Geospatial Foundation, and it is a core component of Spatial Data Infrastructure deployments across Europe and beyond, including the backend of the European INSPIRE geoportal. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31.

The chain combines a missing authorization check with an unsafe transformation engine. CVE-2026-63219 (CVSS 8.6) is a missing authorization check on the formatter upload endpoint that lets an anonymous user write arbitrary .xsl or .zip formatter files to the server, which alone is unauthorized write access to server storage. CVE-2026-58400 (CVSS 9.1) is an unsafe configuration of the Saxon XSLT processor used to render formatters: because Java extension functions are not disabled, any stylesheet it loads can call java.lang.Runtime.exec() or ProcessBuilder and run operating-system commands as the GeoNetwork process user. On its own the second flaw needs upload privileges, which is why it is scored as requiring high privileges, but chained with the first, the attacker supplies both the file and the trigger without authenticating.

Which GeoNetwork versions are affected and how do I fix it?

Upgrade to a fixed release: 4.4.12 or 4.2.17, published July 8, 2026. Because the details were only published on August 31 while the fix predates them by weeks, any internet-reachable GeoNetwork that has not updated since early July should be treated as exposed, and operators of government or INSPIRE-linked geoportals in particular should prioritize it.

Why is the government-backend angle the real risk?

Because GeoNetwork is quietly load-bearing for public geospatial infrastructure, and the people who run those portals may not track it as a high-risk internet-facing app. An unauthenticated RCE on a catalog that backs national and EU geoportals is a foothold into government-adjacent networks, and the gap between the July fix and the late-August disclosure means some operators are only now learning they needed to patch. Software that is critical but unglamorous is exactly where patch latency tends to be worst.

Our read

This is the classic profile of a dangerous open-source dependency: widely deployed in high-value environments, maintained by a foundation rather than a vendor with a push-update channel, and easy to forget you are even running. The chain turns two moderate-sounding issues into unauthenticated code execution, which is why the composite matters more than either CVE alone. The verifiable step is to inventory whether GeoNetwork sits behind any of your portals and confirm it is on a fixed build, rather than assuming a component you did not choose directly is someone else's problem.

Reporting by The Hacker News; CVSS and affected-version detail per the GeoNetwork advisory. Sources linked above.

Related: What is a software supply chain attack? and How to prioritize vulnerabilities.