Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

OSGeo GeoServer actively exploited XXE flaw (CVE-2025-58360)

Vulnerability
First reported
Last updated
Happening score
H score 50
1 unique sources, 1 articles

Summary

Hide ▲

CISA added CVE-2025-58360 in OSGeo GeoServer to the KEV catalog after evidence of active exploitation in the wild. The flaw is an unauthenticated XXE issue affecting all versions through 2.25.5 and 2.26.0 through 2.26.1, with fixes now available in later releases. Successful abuse could enable arbitrary file access, SSRF, or DoS against exposed GeoServer instances.

Cases

GeoServer exploitation, federal breach, and monetization activity (4)

Related Happenings

SolarWinds Serv-U advisory and mitigations for CVE-2026-28318

Advisory/Mitigation
H score52 First: 06.06.2026 11:14 Last: 06.06.2026 11:14 Sources 1

About this happening: **SolarWinds Serv-U** mitigation guidance now covers **CVE-2026-28318**, reducing **unauthenticated DoS** risk from specially crafted POST requests. SolarWinds says the flaw is ad...

Open Happening

CISA KEV remediation deadline for SolarWinds WHD CVE-2025-40551

Public Sector Action
H score53 First: 04.02.2026 07:50 Last: 04.02.2026 07:50 Sources 1

About this happening: **CISA** added **CVE-2025-40551** in **SolarWinds Web Help Desk** to the **KEV catalog** and imposed **federal remediation deadlines**, turning a newly exploited flaw into a compl...

Open Happening

CISA orders FCEB GeoServer patching

Public Sector Action
H score73 First: 12.12.2025 11:48 Last: 12.12.2025 11:48 Sources 1

About this happening: CISA added **CVE-2025-58360** to its **KEV Catalog** and ordered **FCEB agencies** to patch **GeoServer** by **January 1st, 2026**, tightening federal exposure to an **actively ex...

Open Happening

CISA FortiWeb remediation order for FCEB agencies

Public Sector Action
H score36 First: 19.11.2025 15:44 Last: 19.11.2025 15:44 Sources 1

About this happening: CISA ordered **U.S. federal civilian agencies** to secure **FortiWeb** within **one week** after the flaw was exploited in **zero-day attacks**, sharply raising the urgency for fe...

Open Happening

Gladinet CentreStack and Triofox workaround for CVE-2025-11371

Advisory/Mitigation
H score40 First: 10.10.2025 22:08 Last: 10.10.2025 22:08 Sources 1

About this happening: **CentreStack** and **Triofox** are affected by **CVE-2025-11371**, a **local file inclusion zero-day** that threat actors have **abused since late September** to read **Web.confi...

Open Happening

Timeline

  1. 12.12.2025 07:01 1 articles · 6mo ago

    CVE-2025-58360 exploit exists in the wild

    Exploitation Observed

    A Canadian Centre for Cyber Security bulletin said an exploit for OSGeo GeoServer CVE-2025-58360 exists in the wild, indicating active exploitation against vulnerable GeoServer deployments.

    Show sources
    Open in new tab
  2. 12.12.2025 07:01 2 articles · 6mo ago

    CISA adds GeoServer CVE-2025-58360 to KEV

    Legal Policy Action Update

    On December 12, 2025, CISA added OSGeo GeoServer CVE-2025-58360 to the Known Exploited Vulnerabilities catalog after evidence of active exploitation in the wild. The unauthenticated XML External Entity flaw affects all versions prior to and including 2.25.5 and 2.26.0 through 2.26.1, with fixed releases available in 2.25.6, 2.26.2, 2.27.0, 2.28.0, and 2.28.1; successful exploitation can expose arbitrary files, enable SSRF, or trigger DoS, and FCEB agencies were advised to apply required fixes by January 1, 2026.

    Show sources
    Open in new tab