Loading story…
Threat actors exploited a critical remote code execution vulnerability (CVE-2024-36401) in the open-source GeoServer platform to breach a U.S. federal civilian executive branch agency. The attackers gained initial access to one GeoServer instance and, over a three-week period, used the same vulnerability to compromise a second GeoServer and move laterally to additional servers, including web and SQL servers. The attackers deployed web shells such as China Chopper, leveraged scripts for persistence and privilege escalation, and used living-off-the-land techniques to evade detection. The breach was detected after the agency's endpoint detection and response (EDR) tool flagged suspicious activity, prompting a CISA-led incident response. CISA noted deficiencies in the agency's response playbook, which allowed the attackers to maintain deeper access during the investigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA disclosed that attackers had breached a U.S. federal civilian agency by exploiting the critical GeoServer vulnerability, warning organizations about the real-world impact of unpatched systems. Multiple outlets reported the same disclosure, but it reflects a single public reporting event.
Threat actors exploited the GeoServer vulnerability to compromise a U.S. federal civilian executive branch agency, according to later CISA reporting. The intrusion established this flaw as more than a theoretical risk and showed active exploitation against government targets.
A critical path traversal vulnerability in GeoServer, tracked as CVE-2024-36401, was publicly disclosed and fixes were made available. The flaw affected GeoTools/GeoServer installations and enabled remote code execution in some configurations.
3 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA released an advisory detailing a breach at a U.S. federal agency caused by exploitation of GeoServer vulnerability CVE-2024-36401. Attackers gained initial access through unpatched public-facing servers, moved laterally, and remained undetected for three weeks due to insufficient patch management, untested incident response plans, and incomplete endpoint monitoring. CISA urges organizations to prioritize patching, regularly test incident response plans, and implement centralized, out-of-band logging to mitigate similar risks.
Jun 29, 2026
CISA has added CVE-2025-58360, a critical XML External Entity (XXE) vulnerability in OSGeo GeoServer, to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. This vulnerability affects the Web Map Service (WMS) GetMap operation, allowing unauthenticated attackers to exploit improperly restricted XML entity references, potentially leading to file disclosure, server-side request forgery (SSRF), and denial-of-service conditions. The flaw impacts multiple 2.25.x and 2.26.x versions of GeoServer, with patches available in later releases such as 2.25.6 and 2.26.2/2.26.3, and has been integrated into public exploit tools and security scanners, increasing the risk of widespread exploitation. CISA’s inclusion of this vulnerability in the KEV catalog mandates federal agencies to remediate affected systems within a set timeframe, underscoring the urgency for all organizations to prioritize patching or isolating vulnerable GeoServer instances. The vulnerability is particularly concerning due to GeoServer’s role in managing geospatial data for critical infrastructure, government, and enterprise GIS deployments, making exploitation a significant risk for data exposure and internal network compromise. CISA strongly recommends that all organizations, not just federal agencies, address this vulnerability as part of their vulnerability management practices to mitigate the threat of active cyberattacks.
Jun 29, 2026
Attackers are actively targeting an unpatched **GeoServer** zero-day shortly after public disclosure, with researchers observing hundreds of exploitation attempts against exposed systems. The flaw is an **SQL injection** issue in GeoServer’s `jsonArrayContains` function and can lead to **remote code execution** in certain deployments, particularly those using **PostGIS** and **Oracle JDBC** data stores. Security researcher **q1uf3ng** publicly disclosed the vulnerability, and **WatchTowr** reported that a small number of source IP addresses began probing for vulnerable servers within hours. Although the observed activity has so far appeared focused on reconnaissance and exploitation attempts rather than confirmed post-compromise actions, defenders were urged to identify internet-exposed GeoServer instances, limit public access where possible, and watch for an official vendor patch because no fix was available at the time of reporting.
Aug 18, 2026