GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

GeoNetwork has fixed two vulnerabilities that can be combined to allow unauthenticated remote code execution on its open-source geospatial metadata catalog. This catalog is used behind many government and agency geoportals. The project released fixed versions 4.4.12 and 4.2.17 on July 8, 2026. Details of the vulnerabilities were published on August 31. GeoNetwork was originally developed at the United Nations Food and Agriculture Organization. The vulnerabilities pose a risk to the security of geoportals that rely on GeoNetwork.