Active Exploitation of GeoServer Zero-Day SQL Injection Vulnerability

Fieldeffect

Active Exploitation of GeoServer Zero-Day SQL Injection Vulnerability

First seen 14 Aug 2026, 05:36 UTC • •69.9

Article Content

1 / 10

Browse articles

ThreatCluster •August 15, 2026 at 02:19 UTC

•GeoServer's unauthenticated SQL injection vulnerability is actively being exploited.
•Hundreds of scanning attempts were recorded within hours of the vulnerability's disclosure.
•No CVE identifier or vendor patch is currently available for this vulnerability.

A newly disclosed zero-day SQL injection vulnerability in GeoServer is being actively exploited, with researchers observing hundreds of scanning attempts shortly after public disclosure on August 13, 2026. The vulnerability affects the jsonArrayContains function, allowing unauthenticated users to inject SQL commands, potentially leading to remote code execution under specific database configurations. GeoServer is widely used by government and private organizations for managing geospatial data, making it a high-value target. As of now, there is no CVE identifier, CVSS score, or vendor patch available for this vulnerability. Organizations using GeoServer are advised to restrict public access to exposed instances and monitor logs for signs of exploitation. The rapid exploitation attempts highlight the urgency for affected organizations to take immediate action.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 58d ago How this analysis works

Timeline

2024-07-01

CVE-2024-36401 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-08-13

Vulnerability disclosed

A zero-day SQL injection vulnerability in GeoServer was publicly disclosed, affecting its jsonArrayContains function.

2026-08-13

Exploitation attempts observed

Researchers reported hundreds of scanning attempts for vulnerable GeoServer instances shortly after the vulnerability was disclosed.

2026-08-14

Ongoing exploitation activity

The active exploitation of the GeoServer vulnerability continues, with no confirmed compromises yet reported.

Cybersecuritynews

2026-08-14

Warning issued to organizations

Security researchers advised organizations to restrict access to internet-facing GeoServer instances and monitor for exploitation signs.

More articles in this cluster (9)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Sql Injection
Zero-day Exploit
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2024-36401

Weakness (1)

CWE-89 - SQL Injection

Affected Platform (1)

GeoServer

Relationships

CVE-2024-36401 targets GeoServer
Sql Injection targets GeoServer
Zero-day Exploit targets GeoServer
T1190 - Exploit Public-Facing Application targets GeoServer
CVE-2024-36401 related to CWE-89 - SQL Injection

Following this threat?

Track CVE-2024-36401 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…