CISA KEV Alert: GeoServer XXE Flaw Under Active Attack Risks Data Theft & Internal Network Scanning

According to the advisory, CISA has added a critical vulnerability affecting OSGeo GeoServer to its Known Exploited Vulnerabilities (KEV) Catalog, tracked as CVE-2025-58360. The flaw is an XML External Entity (XXE) vulnerability in GeoServer’s handling of XML input, exploiting the /geoserver/wms endpoint during GetMap operations.

By crafting a malicious XML request, an attacker can cause the server’s XML parser to process external references, enabling data theft, internal network scanning via SSRF, and potential service disruption through DoS. Data theft could allow reading arbitrary files from the server’s file system, including confidential data.

With active exploitation, federal agencies have a remediation deadline of 1 January 2026 to patch their systems, and administrators are urged to upgrade GeoServer to versions 2.25.6, 2.26.3, or 2.27.0 immediately. The warning from CISA highlights the vulnerability as a frequent attack vector posing significant risks to federated networks.