Zero-Day GeoServer SQLi Exploited Within Hours, RCE Risk Looms
Within hours of public disclosure, threat actors began probing GeoServer instances for an unauthenticated SQL injection in the jsonArrayContains filter that can lead to remote code execution. WatchTowr recorded hundreds of attempts from a handful of IPs, and with no patch available, organizations should isolate exposed servers and monitor for malicious activity.