VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 12:07 UTC

CVE-2025-58360

Read full description

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.

CVSS 8.2 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.5/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.2: +1.23
Fresh EPSS: 61.17%: +0.31

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

The Hacker News

Press · 02 Sep 2026, 07:00 · GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends - The Hacker News

Recorded Future

Press · 13 Jan 2026, 08:00 · December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity - Recorded Future

Bitsight

Press · 22 Dec 2025, 08:00 · Top Cybersecurity TTPs used by Threat Actors in 2025 - Bitsight

CSO Online

Press · 15 Dec 2025, 08:00 · CISA orders immediate patching as GeoServer flaw faces active exploitation - CSO Online

SecurityWeek

Press · 12 Dec 2025, 08:00 · Recent GeoServer Vulnerability Exploited in Attacks - SecurityWeek

See all 10 source documents

Field Effect

Press · 12 Dec 2025, 08:00 · CISA adds critical GeoServer vulnerability to KEV - Field Effect

The Hacker News

Press · 12 Dec 2025, 08:00 · CISA Flags Actively Exploited GeoServer XXE Flaw in Updated KEV Catalog - The Hacker News

BleepingComputer

Press · 12 Dec 2025, 08:00 · CISA orders feds to patch actively exploited Geoserver flaw - BleepingComputer

Unit 42

Press · 03 Nov 2025, 08:00 · Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3) - Unit 42

XBOW

Press · 23 Sep 2025, 07:00 · Apache Druid Proxy Vulnerability Explained - XBOW

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.5 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.2; EPSS 61.2%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:42.332197+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

23 Sep 2025, 07:00

Published

25 Nov 2025, 20:17

Added to the CISA KEV catalog

11 Dec 2025, 00:00

Latest press mention

02 Sep 2026, 07:00

Score calculated

05 Nov 2026, 13:59