GeoNetwork Unauthenticated RCE Vulnerabilities Chained, Patches Released

The GeoNetwork open-source geospatial metadata catalog project has released fixes for two vulnerabilities that, when chained, allow unauthenticated remote code execution (RCE). The vulnerabilities affect GeoNetwork versions prior to 4.4.12 and 4.2.17. The software is widely deployed behind government and agency geoportals, making the flaws particularly significant for public-sector cybersecurity.

The project shipped the patched versions on July 8, 2026, and published detailed vulnerability information on August 31, 2026. According to reporting, the chained nature of the vulnerabilities enables attackers without valid credentials to execute arbitrary code on backend systems powering government geoportals.

The exact technical mechanism of the vulnerability chain has not been fully detailed in initial reporting. However, the combination of the two flaws removes the authentication requirement, allowing unauthenticated attackers to achieve remote code execution. Successful exploitation could lead to full system compromise of servers hosting GeoNetwork, data exfiltration, lateral movement into connected networks, and manipulation of geospatial metadata catalogs used by government agencies.

Users are advised to upgrade to GeoNetwork versions 4.4.12 or 4.2.17 immediately. The official GeoNetwork security advisory, published August 31, 2026, contains detailed patch information and CVE assignments.