A critical zero-day vulnerability in **GeoServer**, an open-source server for sharing geospatial data, has been actively exploited. The flaw, initially disclosed on August 12, 2026, by researcher **@q1uf3ng** on X, is an SQL injection vulnerability that can lead to remote code execution (RCE). Threat intelligence platform **watchTowr** observed exploitation attempts within hours of public disclosure, noting hundreds of probes from a small pool of IP addresses. "Currently, we're seeing attackers probe to identify vulnerable systems across the internet, triggering errors and not proceeding further," stated Jake Knott, principal security researcher at **watchTowr**. "However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in **CISA**'s Known Exploited Vulnerabilities catalog." ### The Vulnerability Explained The vulnerability, now tracked under the **GitHub** security advisory identifier **GHSA-mqjf-5f49-2fjh** and assigned a **CVSS** score of 9.8, specifically impacts the `jsonArrayContains` function when executing **OGC Filters** with **PostGIS DataStore** implementation. According to project maintainers, the issue arises in **PostGIS** 12 or greater when a String or JSON field is used. The `jsonArrayContains(<column>, <pointer>, <value>)` function writes the `<value>` directly into the generated SQL without proper escaping. This flaw is a regression of **CVE-2023-25158**, another critical SQL injection vulnerability addressed in February 2023. ### Path to Remote Code Execution Security researcher Melvin Lammerts of **Hadrian** further detailed that an attacker-controlled value is interpolated directly into a **PostgreSQL** `jsonb_path_exists()` expression without escaping. This direct interpolation allows for SQL injection. Crucially, this can be escalated to RCE by leveraging **Web Feature Service (WFS) 1.0**. If **GeoServer** connects to **PostgreSQL** using a superuser or a role with `pg_execute_server_program`, the SQL injection can lead to OS command execution on the database host. Even without elevated **PostgreSQL** privileges, the SQL injection can still be used to access data available to the database user. ### Patch and Mitigation **GeoServer** has swiftly released patched versions to address this critical vulnerability: * **GeoServer** 3.0.1 * **GeoServer** 2.28.5 * **GeoServer** 2.27.6 These updates fix the issue in the **Maven** package `org.geotools:gt-jdbc-postgis` in versions 35.1 (fixing 35.0), 34.5 (fixing >=34.0), and 33.6 (fixing >=33.1). Organizations running **GeoServer** are strongly advised to update to the latest patched versions immediately. In the interim, it is crucial to identify any publicly exposed instances, restrict access, and monitor systems for suspicious activity.