An unpatched SQL injection bug in GeoServer, the open-source platform for managing and publishing geospatial data, is drawing active probes. Exploitation attempts began within hours of the vulnerability’s public disclosure.
The bug sits in the jsonArrayContains function and lets unauthenticated users inject SQL commands into the underlying database. On configurations where the database runs with administrator privileges on Microsoft SQL Server, the injection escalates to command execution on the system, turning the flaw into a remote code execution vector. A separate researcher confirmed they could reproduce the issue in a non-default setup.
Security firm watchTowr said it logged hundreds of attempts originating from a small number of source IP addresses shortly after a bug bounty hunter disclosed the flaw on Wednesday. So far the traffic looks like reconnaissance rather than payload delivery, with no malicious commands observed, but researchers expect that to change quickly. GeoServer has a history of active exploitation, and its user base spans government, defense, science, education, and engineering organizations that attackers treat as high-value targets.
With no fix on the calendar, the practical play is containment. Pull internet-exposed GeoServer deployments offline or gate them behind access controls, and scan logs for signs the flaw was already hit. Anyone running the platform in production should treat the disclosure window as an active threat period and assume probes will keep escalating.
The incident is the latest reminder of how fast the gap between disclosure and weaponization has narrowed, with multiple recent vulnerabilities drawing in-the-wild attempts within hours of their CVEs going public.
