Top Highlights
-
High-Severity Vulnerability: CISA identified a critical XML External Entity (XXE) vulnerability (CVE-2025-58360, CVSS score 8.2) in OSGeo GeoServer, linked to active exploitation globally.
-
Affected Versions: The vulnerability impacts all versions up to 2.25.5 and specific versions 2.26.0 to 2.26.1; patches are available in newer versions since 2.25.6.
-
Exploitation Risks: An attacker could exploit this flaw to access server files, conduct Server-Side Request Forgery (SSRF), or launch denial-of-service (DoS) attacks, compromising server integrity.
-
Urgent Security Compliance: Federal agencies must implement fixes by January 1, 2026, amid reports of ongoing exploitation and an additional critical vulnerability (CVE-2024-36401, CVSS score 9.8) affecting the same software.
Active Exploitation of GeoServer Vulnerability Identified
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added a critical security flaw in OSGeo GeoServer to its Known Exploited Vulnerabilities (KEV) catalog. This move comes after evidence of active exploitation surfaced. The vulnerability, identified as CVE-2025-58360, boasts a CVSS score of 8.2. It affects all versions prior to and including 2.25.5, as well as versions 2.26.0 through 2.26.1. Fortunately, patches are available in later releases, specifically versions 2.25.6, 2.26.2, 2.27.0, 2.28.0, and 2.28.1. Acknowledgment goes to the AI-powered platform XBOW for discovering this critical issue.
CISA described the flaw as an improper restriction of XML external entity references. This vulnerability becomes apparent when the application processes XML input through a specific endpoint for GetMap operations. Hackers could exploit this to define external entities within the XML request, potentially compromising the server’s security.
Consequences and Immediate Recommendations
Successful exploitation could lead to severe consequences. Attackers might access arbitrary files on the server, conduct Server-Side Request Forgery (SSRF) attacks on internal systems, or even launch denial-of-service (DoS) attacks by overwhelming server resources. Despite the seriousness of the vulnerability, specific details on current real-world exploitation remain scarce. However, a recent bulletin from the Canadian Centre for Cyber Security confirmed the existence of exploits in the wild.
Additionally, another critical flaw in GeoServer, CVE-2024-36401, received attention for its exploitation by several threat actors throughout the past year. CISA urges Federal Civilian Executive Branch agencies to apply necessary fixes by January 1, 2026, ensuring their networks remain secure. Stakeholders must act promptly to mitigate risks and protect their infrastructure from potential threats.
Continue Your Tech Journey
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Discover archived knowledge and digital history on the Internet Archive.
DataProtection-V1
