{"id":2402,"date":"2026-08-18T06:09:00","date_gmt":"2026-08-18T06:09:00","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2402"},"modified":"2026-08-18T06:09:00","modified_gmt":"2026-08-18T06:09:00","slug":"geoserver-zero-day-targeted-in-active-exploitation-attempts-can-lead-to-rce","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2402","title":{"rendered":"GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE"},"content":{"rendered":"
\n
<\/a><\/div>\n

A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr.<\/p>\n

The vulnerability, which has yet to be assigned a CVE identifier, is an SQL injection vulnerability in the open-source platform that can lead to remote code execution (RCE). The security defect remains unpatched.<\/p>\n

It was first disclosed<\/a> on August 12, 2026, at 10:46 UTC, by a researcher named @q1uf3ng on X. \u00abGeoServer jsonArrayContains unauthorized SQL injection, and in the case of the sa [system administrator] database, it’s naturally possible to achieve RCE,\u00bb the researcher said.<\/p>\n

The threat intelligence and exposure management platform said it began to observe exploitation attempts within hours of public disclosure, and that it has seen hundreds of attempts originating from a small pool of IP addresses. <\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abCurrently, we’re seeing attackers probe to identify vulnerable systems across the internet, triggering errors and not proceeding further,\u00bb Jake Knott, principal security researcher at watchTowr, told The Hacker News in a statement.<\/p>\n

\u00abHowever, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. More importantly, under certain configurations, this latest vulnerability could ultimately lead to remote code execution.\u00bb<\/p>\n

In the absence of a patch, organizations running GeoServer are advised to identify exposed instances, restrict public access, and monitor for a vendor fix.<\/p>\n

In 2024, a critical security flaw impacting GeoServer GeoTools (CVE-2024-36401, CVSS score: 9.8) came under active exploitation to turn compromised devices into DDoS and cryptocurrency mining botnets, and residential proxies.<\/p>\n

Update<\/h3>\n

GeoServer has released versions 3.0.1<\/a>, 2.28.5<\/a>, and 2.27.6<\/a> to address the critical SQL injection vulnerability, which has now been assigned the GitHub security advisory identifier \u00abGHSA-mqjf-5f49-2fjh.\u00bb It carries a CVSS score of 9.8 out of 10.0.<\/p>\n

\u00abAn SQL injection vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function,\u00bb the project maintainers said<\/a> in an alert, adding it requires PostGIS 12 or greater with a String or JSON field.<\/p>\n

\u00abFor PostGIS 12 and greater, jsonArrayContains(, , ) function writes into generated SQL without escaping.\u00bb<\/value><\/value><\/pointer><\/column><\/p>\n

The issue impacts the following versions of the Maven package \u00aborg.geotools:gt-jdbc-postgis\u00bb –<\/p>\n