InfoSecBulletin Cybersecurity for mankind
CISA has ordered U.S. federal agencies to fix a serious GeoServer vulnerability that is currently being exploited in XML External Entity (XXE) injection attacks.
CISA reported a security flaw (CVE-2025-58360) on Thursday, an unauthenticated XML External Entity (XXE) vulnerability in GeoServer 2.26.1 and earlier versions. This open-source server for geospatial data can be exploited to access sensitive files from affected servers.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
“An XML External Entity (XXE) vulnerability was identified affecting GeoServer 2.26.1 and prior versions. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap,” a GeoServer advisory explains.
“However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.”
The Shadowserver group now monitors 2,451 IP addresses with GeoServer fingerprints, while Shodan reports over 14,000 instances exposed online.
CISA has listed CVE-2025-58360 in its Known Exploited Vulnerabilities Catalog, indicating it’s actively exploited. FCEB agencies must patch servers by January 1, 2026, as per Binding Operational Directive 22-01 from November 2021.
BOD 22-01 is targeted at federal agencies, but the U.S. cybersecurity agency recommended that all network defenders quickly patch this vulnerability.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said. “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
