Reported by 3 outlets

Timeline

1. original reporting

   Hackers Exploiting Unpatched GeoServer Zero-Day

   securityweek.com · 60d ago · August 14th, 2026

2. update from cyberpress.org

   GeoServer Zero-Day SQL Injection Lets Unauthenticated Attackers Target Servers for RCE

   cyberpress.org · 60d ago · August 14th, 2026

   A newly disclosed zero-day vulnerability in GeoServer is drawing urgent attention after security researchers reported that an unauthenticated SQL injection could allow attackers to target exposed geospatial servers and, under specific conditions, achieve remote code execution. The vulnerability reportedly affects GeoServer’s handling of the jsonArrayContains function within OGC filter processing. GeoServer is widely used to publish geospatial data through standards-based services, including Web Map Service, Web Feature Service, and Web Coverage Service. These services can accept Common Query Language and filter expressions that are ultimately translated into database queries. If attacker-controlled input is incorporated into that query construction without adequate parameterization, an attacker may be able to alter the underlying SQL command. GeoServer Zero-Day SQL Injection The issue was disclosed publicly by a researcher using the handle @q1uf3ng, who described it as an unauthorized SQL injection vulnerability related to jsonArrayContains . The researcher further claimed that remote code execution could be obtained in deployments using an sa database configuration. At publication time, no CVE identifier or vendor patch had been publicly confirmed, leaving defenders to assess exposure based on their GeoServer version, datastore settings, and database permissions. Proof-of-concept material accompanying the disclosure shows how malformed filter input can produce backend error

3. update from gbhackers.com

   GeoServer Zero-Day SQL Injection Vulnerability Actively Exploited to Gain RCE

   gbhackers.com · 60d ago · August 14th, 2026

   A newly disclosed, unpatched SQL injection vulnerability in GeoServer is currently being actively tested across the internet. Researchers have issued warnings that affected deployments may be vulnerable to remote code execution (RCE) under specific database configurations. At this time, the flaw does not have a CVE identifier or a vendor patch. The issue was publicly […] The post GeoServer Zero-Day SQL Injection Vulnerability Actively Exploited to Gain RCE appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .