GeoServer Zero-Day SQL Injection Exploited in Wild
Threat actors are actively exploiting an unpatched SQL injection in GeoServer that enables remote code execution. No patch available; restrict exposure immediately.
airgap Active exploitation confirmed. No patch. GeoServer installations reachable from untrusted networks are at immediate risk.
What’s Known
SecurityWeek reported today (August 14) that threat actors are actively exploiting an unpatched SQL injection in GeoServer, the open-source Java geospatial server. Exploitation path: SQL injection → remote code execution. No CVE assigned as of this writing.
Confidence: single-source (SecurityWeek). Credible; not independently confirmed.
Exposure Surface
GeoServer serves geographic data over WMS, WFS, and WCS endpoints. Government agencies, municipalities, utilities, and environmental monitoring systems run it — many instances are public-facing by design. Wide deployment, frequent internet exposure.
No affected version range disclosed. No vendor advisory. No CVE. No patch.
If your instance is publicly reachable: live risk.
Immediate Actions
No patch exists. Available mitigations:
- Remove internet exposure. Firewall to authorized IPs or move behind VPN until a patch ships.
- Restrict access. For instances that must stay up, deny all source IPs except known-good ranges at the perimeter.
- Check logs. Look for malformed or anomalously long filter parameters in WMS/WFS request logs.
- Monitor the GeoServer project for a security advisory. Treat it as P1 when it arrives.
CISA KEV: not listed as of this writing. Active exploitation of an unpatched RCE meets KEV criteria. Track updates at KEV tracker.
Source: SecurityWeek — Hackers Exploiting Unpatched GeoServer Zero-Day
Found this useful? Share it.
