Loading story…
Attackers are actively targeting an unpatched GeoServer zero-day shortly after public disclosure, with researchers observing hundreds of exploitation attempts against exposed systems. The flaw is an SQL injection issue in GeoServer’s jsonArrayContains function and can lead to remote code execution in certain deployments, particularly those using PostGIS and Oracle JDBC data stores.
Security researcher q1uf3ng publicly disclosed the vulnerability, and WatchTowr reported that a small number of source IP addresses began probing for vulnerable servers within hours. Although the observed activity has so far appeared focused on reconnaissance and exploitation attempts rather than confirmed post-compromise actions, defenders were urged to identify internet-exposed GeoServer instances, limit public access where possible, and watch for an official vendor patch because no fix was available at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Security researcher q1uf3ng publicly disclosed a GeoServer zero-day on Wednesday. The flaw was described as an SQL injection issue in the jsonArrayContains function that can lead to remote code execution in certain PostGIS and Oracle JDBC configurations.
Within hours of the public disclosure, attackers began targeting the unpatched GeoServer zero-day. WatchTowr observed hundreds of exploitation attempts from a small number of source IP addresses, with activity focused on probing vulnerable systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has added CVE-2025-58360, a critical XML External Entity (XXE) vulnerability in OSGeo GeoServer, to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. This vulnerability affects the Web Map Service (WMS) GetMap operation, allowing unauthenticated attackers to exploit improperly restricted XML entity references, potentially leading to file disclosure, server-side request forgery (SSRF), and denial-of-service conditions. The flaw impacts multiple 2.25.x and 2.26.x versions of GeoServer, with patches available in later releases such as 2.25.6 and 2.26.2/2.26.3, and has been integrated into public exploit tools and security scanners, increasing the risk of widespread exploitation. CISA’s inclusion of this vulnerability in the KEV catalog mandates federal agencies to remediate affected systems within a set timeframe, underscoring the urgency for all organizations to prioritize patching or isolating vulnerable GeoServer instances. The vulnerability is particularly concerning due to GeoServer’s role in managing geospatial data for critical infrastructure, government, and enterprise GIS deployments, making exploitation a significant risk for data exposure and internal network compromise. CISA strongly recommends that all organizations, not just federal agencies, address this vulnerability as part of their vulnerability management practices to mitigate the threat of active cyberattacks.
Jun 29, 2026
GeoServer and Apache CXF disclosed separate XML External Entity vulnerabilities that could let attackers abuse unsafe XML parsing to access sensitive resources. In GeoServer, **CVE-2025-30220** affects the Web Feature Service (`WFS`) through the GeoTools library, where in-memory XSD schema processing does not enforce GeoServer’s `ENTITY_RESOLUTION_ALLOWLIST` restriction. The flaw can enable **information disclosure** and **server-side request forgery (SSRF)** via malicious XML containing external entities or DTDs, with affected GeoServer versions including `2.27.0`, `2.26.0` through `2.26.2`, and versions up to `2.25.6`. Apache also disclosed **CVE-2026-44618**, an important-severity XXE flaw in the WS-Transfer functionality of Apache CXF caused by an insecure XML parser configuration. Affected versions include `org.apache.cxf:cxf-rt-ws-transfer` `4.2.0` before `4.2.1`, `4.0.0` before `4.1.6`, and all `3.6.x` releases before `3.6.11`. Vendors urged organizations to upgrade to fixed releases immediately; where GeoServer patching is delayed, defenders were advised to restrict access to `WFS` endpoints and monitor for suspicious XML requests and outbound activity consistent with SSRF attempts.
Jun 29, 2026
Esri has addressed a critical SQL injection vulnerability in its ArcGIS Server product, which received a maximum CVSS score of 10.0, indicating the highest level of severity. The vulnerability affected ArcGIS Server versions 11.3, 11.4, and 11.5, as confirmed by both Esri and the Canadian Centre for Cyber Security. This flaw could allow remote attackers to exploit the system, potentially leading to unauthorized access, data exfiltration, or manipulation of geospatial data managed by organizations using ArcGIS Server. The vulnerability was disclosed publicly on October 6, 2025, and Esri promptly released a security advisory and a dedicated patch to mitigate the risk. The Canadian Cyber Centre issued an alert on October 9, 2025, urging all users and administrators of the affected ArcGIS Server versions to review the official advisories and apply the security updates without delay. The SQL injection vulnerability posed a significant threat to organizations relying on ArcGIS Server for critical mapping, spatial analysis, and geospatial data services. Attackers exploiting this flaw could have executed arbitrary SQL commands against the backend database, potentially compromising the confidentiality, integrity, and availability of sensitive geospatial information. The rapid response from Esri included the release of a Feature Services Security Patch, which is essential for closing the attack vector. Security professionals are advised to verify their ArcGIS Server deployments, ensure that the latest patches are applied, and review system logs for any signs of attempted exploitation. The incident underscores the importance of timely patch management and the need for organizations to monitor vendor advisories for critical vulnerabilities in widely used enterprise software. Esri’s advisories provided detailed guidance on the affected versions and the steps required to remediate the issue. The vulnerability’s critical rating highlights the potential for automated exploitation, making immediate action imperative for all organizations using the impacted versions. The patch not only addresses the specific SQL injection flaw but also reinforces the overall security posture of ArcGIS Server installations. Organizations are encouraged to follow best practices for web application security, including input validation and least privilege access, to further reduce the risk of similar vulnerabilities in the future. The coordinated disclosure and response demonstrate effective collaboration between the vendor and cybersecurity authorities. This incident serves as a reminder for all enterprises to maintain robust vulnerability management processes and to prioritize remediation of critical flaws in core infrastructure platforms.
Jun 29, 2026