Unpatched GeoServer Zero-Day SQL Injection (jsonArrayContains, GHSA-mqjf-5f49-2fjh) Under Active Exploitation

Unpatched GeoServer Zero-Day SQL Injection (TL-2026-2037), also tracked as GeoServer jsonArrayContains SQL Injection, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-13. It has no confirmed attribution, affects OSGeo / GeoSolutions / GeoCat GeoServer, maps to 15 MITRE ATT&CK techniques (T1053.003, T1059, T1059.001), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-2037

Threat ID
TL-2026-2037
Also known as
GeoServer jsonArrayContains SQL Injection, GHSA-mqjf-5f49-2fjh
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-13
Last reviewed
2026-08-13
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, defense, science, education, engineering, technology
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in Unpatched GeoServer Zero-Day SQL Injection

Malware and tooling: Condi, Mirai (JenX variant), SideWalk (ELF), xmrig, China Chopper, RingQ, Stowaway

An uncoordinated public disclosure on August 12, 2026 by researcher @q1uf3ng exposed a critical unauthenticated SQL injection in GeoTools' jsonArrayContains OGC Filter function against PostGIS DataStores, which can escalate to remote code execution under database-administrator configurations. watchTowr recorded hundreds of scanning/probing exploitation attempts from a small pool of source IPs within hours of disclosure, before a patch (GeoServer 3.0.1/2.28.5/2.27.6, GeoTools gt-jdbc-postgis 35.1/34.5/33.6) shipped on August 14-15, 2026 as GHSA-mqjf-5f49-2fjh.

How Unpatched GeoServer Zero-Day SQL Injection works

On August 12, 2026 at 10:46 UTC, researcher @q1uf3ng publicly disclosed on X — without following coordinated vulnerability disclosure procedures — a critical SQL injection vulnerability in GeoTools' `jsonArrayContains(<column>, <pointer>, <value>)` OGC Filter function. The function writes the caller-supplied `<value>` argument directly into generated SQL without escaping when queried against a PostGIS DataStore (PostGIS 12+) with a String or JSON field, allowing an unauthenticated attacker to inject arbitrary SQL. Under configurations where the backing database account holds administrator privileges, the injection can be leveraged to execute operating-system commands, escalating a data-layer SQL injection into full remote code execution. The GeoTools advisory states "no mitigation is available at this time" and that the previously recommended workaround (prepared statements + disabled PostGIS encode functions) does not stop this instance. Some reporting additionally flags certain H2 DataStore configurations as a further RCE path, though the exact conditions required have not been publicly documented as of August 13, 2026.

The flaw is a regression of the jsonArrayContains SQL-injection class first disclosed on February 20, 2023 as CVE-2023-25157 (GeoServer) / CVE-2023-25158 (GeoTools, GHSA-99c3-qc2q-p94m).

watchTowr began observing exploitation activity within hours of the public disclosure, documenting hundreds of attempts originating from a small pool of source IP addresses. Principal researcher Jake Knott characterized the observed activity as reconnaissance — attackers triggering SQL errors to fingerprint vulnerable, internet-facing GeoServer instances rather than delivering follow-on payloads — but cautioned this is unlikely to remain the case for long given GeoServer's "track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog."

That track record includes CVE-2024-36401 (CVSS 9.8, an unrelated GeoTools property-name/XPath eval-injection RCE via Apache Commons JXPath), which CISA added to its KEV catalog on July 15, 2024. Per CISA advisory AA25-266A (published September 23, 2025), threat actors exploited CVE-2024-36401 to gain unauthenticated RCE on a U.S. federal civilian agency's internet-facing GeoServer on July 11, 2024; the intrusion went undetected for roughly three weeks because the web server lacked EDR coverage. During that window the actors used PowerShell and `xp_cmdshell` for execution, pivoted from the web server to an internal SQL server, breached a second internet-facing GeoServer via the same CVE on July 24, 2024, and moved laterally to two additional servers. Persistence was established via China Chopper/PHP web shells, Windows local-account creation (`net user`), and Linux cron jobs; the RingQ evasion loader was used to hinder AV/EDR detection; and Stowaway, a multi-level reverse-proxy utility, tunneled command-and-control traffic over HTTP on TCP/4441. Separately, FortiGuard Labs and other researchers documented mass, opportunistic exploitation of CVE-2024-36401 since mid-2024 — reportedly affecting roughly 7,100 internet-facing GeoServer instances worldwide — to deploy XMRig cryptocurrency miners, the Mirai-variant "JenX" and Condi DDoS botnet malware, the SideWalk backdoor, and residential-proxy monetization tooling.

GeoServer/GeoTools maintainers (Andrea Aime of GeoSolutions and Jody Garnett of GeoCat) shipped fixed releases — GeoServer 3.0.1, 2.28.5, and 2.27.6, and GeoTools gt-jdbc-postgis 35.1, 34.5, and 33.6 — on August 14-15, 2026, publishing the fix as GitHub Security Advisory GHSA-mqjf-5f49-2fjh (CWE-89, CVSS 3.1 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), tracked via GeoTools JIRA ticket GEOT-7958 / PR #5829. No CVE identifier had been assigned as of the advisory's publication. GeoServer's user base spans government, defense, science, education, engineering, and technology sectors, consistent with its documented history of being a high-value target for opportunistic internet-wide scanning campaigns.

MITRE ATT&CK techniques used in TL-2026-2037

Persistence

T1053.003 Scheduled Task/Job: Cron; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Execution

T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter: PowerShell

Command and Control

T1090.001 Proxy: Internal Proxy

Initial Access

T1190 Exploit Public-Facing Application

stealth

T1197 BITS Jobs

Collection

T1213 Data from Information Repositories

Impact

T1496 Resource Hijacking; T1565.001 Data Manipulation: Stored Data Manipulation

Resource Development

T1584.005 Compromise Infrastructure: Botnet; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Unpatched GeoServer Zero-Day SQL Injection

  • OSGeo / GeoSolutions / GeoCat — GeoServer
    Vulnerable versions: < 2.27.6; < 2.28.5; < 3.0.1
    Fixed in: 3.0.1; 2.28.5; 2.27.6
  • GeoTools — org.geotools:gt-jdbc-postgis
    Vulnerable versions: 33.1-33.5; 34.0-34.4; 35.0
    Fixed in: 33.6; 34.5; 35.1

Remediation for Unpatched GeoServer Zero-Day SQL Injection

Patches

  • GeoServer 3.0.1 / 2.28.5 / 2.27.6 (August 14-15, 2026)
  • GeoTools org.geotools:gt-jdbc-postgis 35.1 / 34.5 / 33.6

Immediate actions

  • Upgrade to GeoServer 3.0.1, 2.28.5, or 2.27.6 (bundles patched GeoTools gt-jdbc-postgis)
  • Upgrade standalone GeoTools deployments to gt-jdbc-postgis 35.1, 34.5, or 33.6
  • If patching is not immediately possible, remove public internet exposure of GeoServer via VPN, reverse proxy, or IP allowlisting
  • Restrict the GeoServer backing database account to least-privilege (non-administrator) permissions to eliminate the RCE escalation path even if the SQLi is triggered
  • Deploy EDR on internet-facing GeoServer hosts and centralize/aggregate logs out-of-band — CISA AA25-266A found the compromised federal GeoServer host had neither

Workarounds

  • Restrict or disable PostGIS DataStore access to jsonArrayContains-capable String/JSON fields where the function is not required
  • Limit the GeoServer database service account to non-administrator privileges to remove the documented RCE escalation path

Longer-term hardening

  • Audit all internet-facing GeoServer/GeoTools deployments and inventory PostGIS-backed DataStores using String or JSON fields
  • Establish a coordinated-disclosure and rapid-patch SLA for GeoServer given its repeated history of SQLi/RCE zero-days (CVE-2023-25157/25158, CVE-2024-36401, GHSA-mqjf-5f49-2fjh)
  • Deploy WAF/reverse-proxy rules to inspect OGC Filter (WFS/WMS) request parameters for jsonArrayContains and other filter-function injection patterns
  • Test incident-response plans against a GeoServer-exploitation scenario and validate EDR alerting coverage on all GIS/geospatial hosts, per CISA AA25-266A lessons learned

Weaknesses (CWE) in Unpatched GeoServer Zero-Day SQL Injection

CWE-89

Timeline of Unpatched GeoServer Zero-Day SQL Injection

  • CVE-2023-25157 (GeoServer) / CVE-2023-25158 (GeoTools, GHSA-99c3-qc2q-p94m) disclosed: the original OGC Filter/jsonArrayContains SQL injection class, of which this 2026 flaw is a regression.
  • CVE-2024-36401, an unrelated GeoTools property-name/XPath eval-injection RCE, disclosed — later exploited in the wild and added to CISA KEV.
  • Threat actors exploit CVE-2024-36401 for initial access against a U.S. federal agency's public-facing GeoServer instance, per CISA AA25-266a.
  • CISA adds CVE-2024-36401 to the Known Exploited Vulnerabilities catalog, requiring federal remediation by August 5, 2024.
  • The same actors breach a second internet-facing GeoServer at the federal agency via CVE-2024-36401 and move laterally to two additional internal servers, per CISA AA25-266A.
  • CISA publishes advisory AA25-266A detailing the federal-agency GeoServer breach TTPs (PowerShell, Stowaway proxy C2, China Chopper web shells) and lessons learned (delayed patching, untested IR plans, missing EDR).
  • watchTowr begins observing exploitation attempts within hours of disclosure, recording hundreds of scanning/probing attempts from a small pool of source IP addresses.
  • Researcher @q1uf3ng publicly discloses the jsonArrayContains SQL injection on X at 10:46 UTC without coordinated vulnerability disclosure.
  • The Hacker News, SecurityWeek, CSO Online, Security Affairs, and Field Effect publish coverage of the unpatched zero-day and active exploitation attempts.
  • GeoServer 3.0.1, 2.28.5, and 2.27.6 (bundling patched GeoTools gt-jdbc-postgis) are released.
  • GitHub Security Advisory GHSA-mqjf-5f49-2fjh formally published for GeoTools gt-jdbc-postgis; no CVE identifier assigned as of publication.

Sources cited for Unpatched GeoServer Zero-Day SQL Injection

Threats related to Unpatched GeoServer Zero-Day SQL Injection

Detection coverage for TL-2026-2037

As of 2026-08-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2037 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats