InfoSecBulletin Cybersecurity for mankind
CISA has ordered U.S. federal agencies to fix a serious GeoServer vulnerability that is currently being exploited in XML External Entity (XXE) injection attacks.
CISA reported a security flaw (CVE-2025-58360) on Thursday, an unauthenticated XML External Entity (XXE) vulnerability in GeoServer 2.26.1 and earlier versions. This open-source server for geospatial data can be exploited to access sensitive files from affected servers.
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
“An XML External Entity (XXE) vulnerability was identified affecting GeoServer 2.26.1 and prior versions. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap,” a GeoServer advisory explains.
“However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.”
The Shadowserver group now monitors 2,451 IP addresses with GeoServer fingerprints, while Shodan reports over 14,000 instances exposed online.
CISA has listed CVE-2025-58360 in its Known Exploited Vulnerabilities Catalog, indicating it’s actively exploited. FCEB agencies must patch servers by January 1, 2026, as per Binding Operational Directive 22-01 from November 2021.
BOD 22-01 is targeted at federal agencies, but the U.S. cybersecurity agency recommended that all network defenders quickly patch this vulnerability.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said. “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
