Neither GeoNetwork flaw is pre-auth RCE. Chained, they are — and 89% of exposed instances are government
2026-09-03Security
One bug lets anyone upload a stylesheet. The other lets a stylesheet run operating-system commands. Ethiack found 121 exposed GeoNetwork deployments across 39 countries, nearly nine in ten of them government, military or national-agency. The fix shipped on 8 July; the advisory arrived on 31 August.