U.S. CISA adds an OSGeo GeoServer flaw to its Known Exploited Vulnerabilities catalog

According to Security Affairs, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an OSGeo GeoServer flaw, tracked as CVE-2025-58360, to its Known Exploited Vulnerabilities catalog with a CVSS score of 8.2. The flaw exists in GeoServer versions 2.26.0–2.26.1 and 2.25.x before 2.25.6, due to an XML External Entity (XXE) vulnerability in the /geoserver/wms GetMap endpoint that could allow access to internal files or trigger server-side requests if unsanitised XML is processed.

The vulnerability is fixed in versions 2.25.6, 2.26.3, and 2.27.0. Canada’s Cyber Centre noted that an exploit is already active in the wild, and the advisory quotes that open-source reporting indicates the exploit exists. CISA also references a Binding Operational Directive (BOD) 22-01 requirement for agencies to address Known Exploited Vulnerabilities, with federal agencies ordered to fix this flaw by 1 January 2026.

The article also recalls a prior incident where threat actors exploited an unpatched GeoServer vuln, CVE-2024-36401, to breach a U.S. federal agency, underscoring the ongoing risk to government and private infrastructure.