GeoServer Zero

Gbhackers •Divya • August 14, 2026

A newly disclosed, unpatched SQL injection vulnerability in GeoServer is currently being actively tested across the internet. Researchers have issued warnings that affected deployments may be vulnerable to remote code execution (RCE) under specific database configurations. At this time, the flaw does not have a CVE identifier or a vendor patch. The issue was publicly […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of GeoServer Zero-Day SQL Injection Vulnerability A newly disclosed zero-day SQL injection vulnerability in GeoServer is being actively exploited, with researchers observing hundreds of scanning attempts shortly after public disclosure on August 13, 2026. The vulnerability affects the jsonArrayContains function, allowing unauthenticated users to inject SQL commands, potentially leading to remote code execution under specific database configurations. GeoServer is widely used by government and private organizations for managing geospatial data, making it a high-value target. As of now, there is no CVE identifier, CVSS score, or vendor patch available for this vulnerability. Organizations using GeoServer are advised to restrict public access to exposed instances and monitor logs for signs of exploitation. The rapid exploitation attempts highlight the urgency for affected organizations to take immediate action. 9 sources 70

Extracted Entities

GeoServer Zero

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)