CISA Flags Actively Exploited GeoServer XXE Flaw in Updated KEV Catalog

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, GeoServer has been added to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation in the wild. The flaw is CVE-2025-58360, an unauthenticated XML External Entity (XXE) vulnerability with a CVSS score of 8.2 that affects all versions up to 2.25.5 and from 2.26.0 to 2.26.1; patches are available in 2.25.6, 2.26.2, 2.27.0, 2.28.0 and 2.28.1.

Artificial intelligence-powered vulnerability discovery platform XBOW has been acknowledged for reporting the issue. The flaw can be triggered via the /geoserver/wms operation GetMap endpoint, potentially allowing access to arbitrary files, SSRF against internal systems, or a DoS by exhausting resources, according to the maintainers’ alert.

Affected packages include docker.osgeo[.]org/geoserver, org.geoserver.web:gs-web-app (Maven) and org[.]geoserver:gs-wms (Maven); Canada’s cyber bulletin also notes that an exploit for CVE-2025-58360 exists in the wild.