GeoServer Zero-Day Is Already Being Probed. That’s the Problem
Unpatched GeoServer zero-day enabling SQL injection and possible RCE is being actively probed across exposed systems.
A zero-day in GeoServer's jsonArrayContains functionality allows unauthorized SQL injection and, in some configurations, remote code execution. Disclosed on August 12, 2026 without a CVE ID, it drew hundreds of exploitation probes from watchTowr within hours. No patch is available yet; GeoServer was previously mass-exploited via CVE-2024-36401.
- Zero-day SQL injection in GeoServer jsonArrayContains may enable RCE
- No CVE assigned and no vendor patch available yet
- Hundreds of probing attempts observed within hours of disclosure
- GeoServer is widely used in government, utilities, and transport
- CVE-2024-36401 history shows GeoServer is exploited at scale
- CVEs
- CVE-2024-36401
- Products
- GeoServer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-36401 | Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection | 9.8 | 100% | KEVPoC ×3 | KEV |
From the original article
3 min read at securityaffairs.com
GeoServer faces an unpatched zero-day enabling SQL injection and potentially RCE, with attackers already probing exposed systems. A newly disclosed GeoServer zero-day is already attracting active exploitation attempts, and there is no patch available yet. Organisations running the open-source geospatial platform should check their exposure.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.