InfoSecBulletin Cybersecurity for mankind
CISA has ordered U.S. federal agencies to fix a serious GeoServer vulnerability that is currently being exploited in XML External Entity (XXE) injection attacks.
CISA reported a security flaw (CVE-2025-58360) on Thursday, an unauthenticated XML External Entity (XXE) vulnerability in GeoServer 2.26.1 and earlier versions. This open-source server for geospatial data can be exploited to access sensitive files from affected servers.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
“An XML External Entity (XXE) vulnerability was identified affecting GeoServer 2.26.1 and prior versions. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap,” a GeoServer advisory explains.
“However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.”
The Shadowserver group now monitors 2,451 IP addresses with GeoServer fingerprints, while Shodan reports over 14,000 instances exposed online.
CISA has listed CVE-2025-58360 in its Known Exploited Vulnerabilities Catalog, indicating it’s actively exploited. FCEB agencies must patch servers by January 1, 2026, as per Binding Operational Directive 22-01 from November 2021.
BOD 22-01 is targeted at federal agencies, but the U.S. cybersecurity agency recommended that all network defenders quickly patch this vulnerability.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said. “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
