GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

The Hacker News

September 2, 2026 at 9:18 AM

Overview

GeoNetwork has addressed two vulnerabilities that could allow attackers to execute remote code without authentication on its geospatial metadata catalog, commonly used by government and agency geoportals. The vulnerabilities were discovered and fixed in versions 4.4.12 and 4.2.17, released on July 8, 2026. This is significant because it exposes systems that rely on GeoNetwork to potential exploitation, which could lead to unauthorized access or control over sensitive data. The details of these vulnerabilities were made public on August 31, 2026, prompting users to update their systems to safeguard against possible attacks. Government agencies and organizations using GeoNetwork should prioritize applying these updates to prevent any exploitation of the vulnerabilities.

Key Takeaways

Affected Systems: GeoNetwork versions prior to 4.4.12 and 4.2.17
Action Required: Update to GeoNetwork versions 4.
Timeline: Disclosed on August 31, 2026

Original Article Summary

Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31. GeoNetwork originated at the United Nations Food and

Impact

GeoNetwork versions prior to 4.4.12 and 4.2.17

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Disclosed on August 31, 2026

Remediation

Update to GeoNetwork versions 4.4.12 or 4.2.17

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability, Update, RCE.

Read Original Article

Related Coverage

How AI Agents Can Trigger Runaway Costs for Enterprises

darkreading

A new concern has emerged regarding the use of AI agents, particularly in the context of unbounded consumption, which OWASP ranks as a significant risk for large language model (LLM) applications. This issue arises when AI systems operate without proper constraints, potentially leading to excessive resource usage and runaway costs for enterprises. Companies leveraging LLM technologies could face financial strain as these agents consume resources beyond expected limits, which could impact budgets and operational efficiency. It’s crucial for organizations to implement controls and monitor AI usage to mitigate these risks effectively. Understanding and addressing this issue is essential for businesses to avoid unexpected expenses and ensure sustainable AI deployment.

Sep 21, 2026

BigCommerce alerts merchants of data breach linked to Ribon apps

BleepingComputer

BigCommerce has informed several merchants about data breaches linked to third-party Ribon applications. Attackers gained access to credentials for these apps and exploited them to insert malicious scripts into online stores. This breach poses a significant risk to affected merchants, potentially compromising customer data and undermining the integrity of their online platforms. The incident raises concerns about the security of third-party integrations and emphasizes the need for merchants to review their app permissions and security practices. Merchants using Ribon applications should take immediate action to secure their accounts and monitor for unusual activity.

Sep 21, 2026

CISA alerts of active exploitation of three Linux kernel flaws

BleepingComputer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of three vulnerabilities in the Linux kernel, with one being classified as critical. These flaws could allow attackers to gain unauthorized access or control over affected systems, posing significant risks to organizations that rely on Linux-based infrastructure. Users and administrators of Linux systems are urged to take immediate action to protect their environments. The vulnerabilities affect various distributions of Linux, and failure to address them could lead to serious security breaches. As these exploits are currently active, it is crucial for those using Linux to stay informed and apply necessary updates promptly.

Sep 21, 2026

ShinyHunters Hacked Clop. Now What About Clop's Victims?

darkreading

ShinyHunters, a notorious hacking group, has reportedly defaced Clop’s Dark Web site and claims to have stolen data belonging to Clop's victims. This action raises concerns for organizations that previously paid ransoms to Clop, as they could face renewed extortion attempts. The stolen data could expose sensitive information, putting these companies at further risk. This incident highlights the ongoing cycle of ransomware attacks and the challenges organizations face in protecting their data after paying ransoms. As the situation develops, affected organizations will need to assess their security postures and prepare for potential follow-up attacks.

Sep 21, 2026

Cybercriminals Are Hiding New Malware in Torrents for Popular Films

darkreading

Recent reports indicate that cybercriminals are embedding malware into torrent files of popular films, targeting users in Africa, particularly in Kenya and Uganda. These malicious files are designed to compromise the devices of individuals who download them, putting their personal information and security at risk. The trend of hiding malware in torrents is concerning, as many users may not be aware of the dangers associated with downloading files from unofficial sources. This incident serves as a reminder for users to be cautious when downloading content online and to consider using security software to detect potential threats. As this method of distribution becomes more common, it raises serious questions about the safety of torrenting and the need for increased public awareness about cybersecurity risks.

Sep 21, 2026

WordPress Click2Shell flaw lets hackers execute PHP on the server

BleepingComputer

A new vulnerability called 'Click2Shell' has been identified in the Core component of WordPress, allowing attackers to execute PHP code on affected servers. This cross-site request forgery (CSRF) flaw poses a significant risk as it could enable unauthorized actions on behalf of users, potentially leading to full server compromise. Technical details and a proof-of-concept exploit have already been published, raising concerns about its exploitation. WordPress users, particularly those running outdated versions, should take this threat seriously. Implementing security updates as soon as they become available is crucial to protect against potential attacks.

Sep 21, 2026