Critical Unpatched GeoServer Zero-Day: Active SQLi Leads to RCE

An unpatched GeoServer zero-day SQL injection flaw is being actively exploited in the wild, leading to full Remote Code Execution (RCE). Read the mitigation guide.

A highly critical, unpatched zero-day vulnerability in the open-source GeoServer platform is currently seeing active exploitation in the wild.

The vulnerability is a severe SQL injection (SQLi) flaw residing in the jsonArrayContains function. By sending specially crafted JSON arrays, attackers can escape SQL query logic. When executed under high privileges (e.g., the sa database account), this directly pivots into full Remote Code Execution (RCE).

There is currently no official patch and no assigned CVE. Administrators must immediately identify all exposed GeoServer instances, forcefully restrict public internet access, and apply strict Web Application Firewall (WAF) filtering rules.

🔗 Read the Full Operational Scope and Threat Matrix on CyberUpdates365