Loading story…
CISA released an advisory detailing a breach at a U.S. federal agency caused by exploitation of GeoServer vulnerability CVE-2024-36401. Attackers gained initial access through unpatched public-facing servers, moved laterally, and remained undetected for three weeks due to insufficient patch management, untested incident response plans, and incomplete endpoint monitoring. CISA urges organizations to prioritize patching, regularly test incident response plans, and implement centralized, out-of-band logging to mitigate similar risks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported that CISA said hackers had breached a federal agency using a GeoServer exploit, amplifying the agency's advisory to a broader audience. This is a distinct reporting event, not a separate breach.
CISA released an alert and cybersecurity advisory sharing lessons learned from its incident response engagement involving the federal agency breach and GeoServer exploitation. The publication documented the incident and provided defensive guidance for other organizations.
According to CISA's later advisory, threat actors gained access to a U.S. federal civilian executive branch agency by exploiting a GeoServer vulnerability during an incident response case. The intrusion is the underlying real-world event described across the references.
3 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecisa.gov
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors exploited a critical remote code execution vulnerability (CVE-2024-36401) in the open-source GeoServer platform to breach a U.S. federal civilian executive branch agency. The attackers gained initial access to one GeoServer instance and, over a three-week period, used the same vulnerability to compromise a second GeoServer and move laterally to additional servers, including web and SQL servers. The attackers deployed web shells such as China Chopper, leveraged scripts for persistence and privilege escalation, and used living-off-the-land techniques to evade detection. The breach was detected after the agency's endpoint detection and response (EDR) tool flagged suspicious activity, prompting a CISA-led incident response. CISA noted deficiencies in the agency's response playbook, which allowed the attackers to maintain deeper access during the investigation.
Jun 29, 2026
CISA has added CVE-2025-58360, a critical XML External Entity (XXE) vulnerability in OSGeo GeoServer, to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. This vulnerability affects the Web Map Service (WMS) GetMap operation, allowing unauthenticated attackers to exploit improperly restricted XML entity references, potentially leading to file disclosure, server-side request forgery (SSRF), and denial-of-service conditions. The flaw impacts multiple 2.25.x and 2.26.x versions of GeoServer, with patches available in later releases such as 2.25.6 and 2.26.2/2.26.3, and has been integrated into public exploit tools and security scanners, increasing the risk of widespread exploitation. CISA’s inclusion of this vulnerability in the KEV catalog mandates federal agencies to remediate affected systems within a set timeframe, underscoring the urgency for all organizations to prioritize patching or isolating vulnerable GeoServer instances. The vulnerability is particularly concerning due to GeoServer’s role in managing geospatial data for critical infrastructure, government, and enterprise GIS deployments, making exploitation a significant risk for data exposure and internal network compromise. CISA strongly recommends that all organizations, not just federal agencies, address this vulnerability as part of their vulnerability management practices to mitigate the threat of active cyberattacks.
Jun 29, 2026
CISA has issued an alert regarding the active exploitation of two critical vulnerabilities: a local file inclusion/remote code execution (LFI/RCE) flaw in *Gladinet CentreStack* and *Triofox* (CVE-2025-11371), and an OS command injection vulnerability in *Control Web Panel* (CWP) (CVE-2025-48703). Both vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog following evidence of in-the-wild attacks, and are considered significant risks for organizations, especially those in the federal enterprise. Federal Civilian Executive Branch (FCEB) agencies are mandated by Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by the specified due date to protect against ongoing threats. CISA strongly recommends that all organizations, not just federal agencies, prioritize patching these vulnerabilities as part of their vulnerability management practices to reduce exposure to cyberattacks leveraging these flaws.
Jun 29, 2026