CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Called exploited 1 days before disclosure.
Measured from the CVE publication date to the earliest of 2 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing1d
- Last KEV listing1d
- Last sightingsame day
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Unionlisted Sep 2, 2026
- VulnCheck KEVcommercial researchlisted Sep 3, 2026
- CIRCLaggregator, mirrors the abovelisted Sep 2, 2026, not counted
2 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationeuvd.enisa.europa.eu/vulnerability/EUVD-2026-70645
1 public report collected from VulnCheck and CIRCL, first on Sep 3, 2026. Each links to its original source. We have not verified them.
Description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process