SecurityThe Hacker Newsabout 2 hours ago
GeoNetwork Fixes Unauthenticated RCE Chain
1 min read
Two GeoNetwork vulnerabilities chain into unauthenticated remote code execution, fixed in versions 4.4.12 and 4.2.17. The flaws, CVE-2026-63219 and CVE-2026-58400, allow anonymous file upload and command execution via Saxon XSLT. Ethiack found 121 exposed deployments across 39 countries, 89 percent government-related.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
