InfoSecBulletin Cybersecurity for mankind
CISA has ordered U.S. federal agencies to fix a serious GeoServer vulnerability that is currently being exploited in XML External Entity (XXE) injection attacks.
CISA reported a security flaw (CVE-2025-58360) on Thursday, an unauthenticated XML External Entity (XXE) vulnerability in GeoServer 2.26.1 and earlier versions. This open-source server for geospatial data can be exploited to access sensitive files from affected servers.
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
“An XML External Entity (XXE) vulnerability was identified affecting GeoServer 2.26.1 and prior versions. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap,” a GeoServer advisory explains.
“However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.”
The Shadowserver group now monitors 2,451 IP addresses with GeoServer fingerprints, while Shodan reports over 14,000 instances exposed online.
CISA has listed CVE-2025-58360 in its Known Exploited Vulnerabilities Catalog, indicating it’s actively exploited. FCEB agencies must patch servers by January 1, 2026, as per Binding Operational Directive 22-01 from November 2021.
BOD 22-01 is targeted at federal agencies, but the U.S. cybersecurity agency recommended that all network defenders quickly patch this vulnerability.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said. “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
