Geo Server Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE
Summary: A zero-day SQL injection flaw in GeoServer's jsonArrayContains function, disclosed August 12, 2026 by researcher @q1uf3ng, drew exploitation attempts within hours, with watchTowr reporting hundreds of attempts from a small pool of IP addresses. The vulnerability, a regression of CVE-2023-25158, is fixed in GeoServer versions 3.0.1, 2.28.5, and 2.27.6 under advisory GHSA-mqjf-5f49-2fjh with a CVSS score of 9.8, and can reach remote code execution when GeoServer connects to PostgreSQL as a superuser or a role with pg_execute_server_program.
What's compelling: GeoServer already has multiple vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, and watchTowr's Jake Knott notes attackers are currently only probing for vulnerable systems - a phase unlikely to last, given that a superuser database connection turns this SQL injection into OS command execution on the database host.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-25157CVE-2023-25158CVE-2024-36401
- Related
- CVE-2024-36401: OSGeo Geo Server Geo Tools Eval Injection Vulnerability Known Exploited Vulnerabilities · Jul 15, 2024