CVE-2024-36401General(geoserver / geoserver)

HIGHCVSS 9.8 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch geoserver geoserver systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

geoserver CVEs Back to dashboard

6.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-08-05. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Patch / fix

Exploit / PoC references

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36401

Weakness type (CWE)

CWE-95CWE-94

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

RISING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

geoserver
geotools

Threat summary

Active exploitation appears in 3 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
11 mentions across 7 observed days

What's happening

Active exploitation reported across 3 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
General: 4 classified signals
Disclosure: 2 classified signals
Peaked 1d ago at 3 mentions (2026-08-27); latest day: 2
11 total mentions across 7 days

Affected systems

Vendors

geoserver geotools

Products

geoservergeotools

2 versions affected across 2 products

Deep dive

Activity timeline11 mentions / 7d

Signal classification3 categories

General

444.4%

Active Exploitation

333.3%

Disclosure

222.2%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-25	2	Disclosure1General1
2026-06-28	1	General1
2026-07-12	1	Disclosure1
2026-07-22	1	Active Exploitation1
2026-08-08	1	Active Exploitation1
2026-08-27	3	Active Exploitation1General2

Full discourse11 posts

Renars Kadzulis@RenarsKadzulis92d
General
@tikums Ja banka vienā naktī pazaudē visu naudu, kuru tai uzticēts sargāt, vai tiešām vainīgs MI, kas, iespējams, palīdzējis zagļiem? Nopietni? Tas nekas, ka par GeoServer kritiskām ievainojamībām zināms kopš 2024.g. (CVE-2024-36401: RCE), kopš 2025.g. (CVE-2025-58360: XXE).
Post summary
The post notes two GeoServer CVEs (RCE and XXE) but offers neither proof of exploitation, patches, nor code, merely referencing the vulnerabilities.
120113346
607 followersView on X
Edgars Jēkabsons 🇪🇺 💙💛@edgarsj91d
Disclosure
https://geoserver.org/vulnerability/2024/09/12/cve-2024-36401.html https://t.co/WJrDbRNBXz
Post summary
A link to a Geoserver vulnerability page for CVE-2024-36401 was shared, but the content does not provide detailed technical information, PoC, exploit code, or patch details.
00031946
2.2K followersView on X
ExploitGrid@exploitgrid9d
[EXPLOIT] CVE-2024-36401 [CRITICAL/PoC] cve-2024-36401-security-simulator 🔗 https://exploitgrid.net/exploits/c2c0b6f4-1371-4bff-83c7-2f8a81061a8c
1000035
45 followersView on X
ExploitGrid@exploitgrid9d
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2024-3094 CVE-2025-24813 CVE-2026-48907 CVE-2026-38526 CVE-2024-36401 ..🧵👇
1000071
45 followersView on X
DFIR Radar@DFIR_Radar65d
Active Exploitation
CVE-2024-36401 still being actively scanned in the wild: the Rondo botnet is hitting GeoServer installs via OGC filter RCE, dropping a shell script through a multi-stage wget/curl chain. Key findings: - CVE-2024-36401 is an XPath expression injection in GeoServer's OGC filter evaluation, allowing unauthenticated RCE via a crafted GetPropertyValue WFS request. The payload calls java.lang.Runtime.getRuntime() directly in the valueReference parameter, no auth required. - The attack chain: URL-encoded exec() call in the WFS request, base64-encoded second stage decoded and piped to sh, fetching rondo.zyt[.]sh from 45.153.34[.]153 via wget, busybox wget, or curl as fallbacks. - The C2 at 45.153.34[.]153 now returns a taunting HTML comment ("You won't find it here"), suggesting the payload was removed or the bot was evicted, but persistent implants may remain. - GeoServer is common in government, utilities, and research environments running geospatial infrastructure, making exposed instances high-value targets for botnet recruitment. Hunt your web logs for GetPropertyValue requests containing exec( or base64 strings in the valueReference parameter. Check for outbound connections to 45.153.34[.]153 and unexpected sh or bash processes spawned from the GeoServer JVM. Patch to GeoServer 2.23.6 / 2.24.4 or later if not already done. #DFIR_Radar
Post summary
CVE-2024-36401 is actively exploited via XPath injection in GeoServer’s OGC filter, delivering a multi‑stage shell script through a botnet; patching to the latest GeoServer release mitigates the risk.
10000156
1.8K followersView on X
r0otk3r@r0otk3r75d
Disclosure
🚨 CVE-2024-36401: Critical 9.8 CVSS GeoServer Unauthenticated RCEHashtags#Cybersecurity https://www.youtube.com/watch?v=zRnCkII5wCI #Infosec #AppSec #RCE #GeoServer #GeoTools #CVE202436401 #PoC #EthicalHacking #BugBounty #PatchNow https://t.co/hK6wre231l
Post summary
The tweet announces CVE-2024-36401, highlighting its critical nature and unauthorized RCE impact on GeoServer, hints at a PoC, and urges patching, but provides no direct exploitation code.
0001040
43 followersView on X
Loginsoft Threat Intel@Loginsoft_Intel28d
Active Exploitation
Cytellite recent detection targeting CVE-2024-36401 — Storm Industries LLC Visit -- https://cti.loginsoft.com/ip/94.154.43.197 #Loginsoft #Cytellite #Cybersecurity #CVE202436401 #LOVI #ThreatIntelligence #Infosecurity #AI https://t.co/JWcbQiDQ0q
Post summary
Cytellite reports that Storm Industries LLC has recently detected activity exploiting CVE-2024-36401.
0000024
23 followersView on X
Loginsoft Threat Intel@Loginsoft_Intel28d
General
Cytellite recent detection targeting CVE-2024-36401 — Storm Industries LLC Visit -- https://cti.loginsoft.com/ip/94.154.43.197 #Loginsoft #Cytellite #Cybersecurity #CVE202436401 #LOVI #ThreatIntelligence #Infosecurity #AI https://t.co/0FCrrFHJZm
Post summary
The tweet references a detection event for CVE-2024-36401 and provides a link, but lacks any technical details, exploit code, or patch information.
0000026
23 followersView on X
Loginsoft Threat Intel@Loginsoft_Intel28d
General
Cytellite recent detection targeting CVE-2024-36401 — Storm Industries LLC Visit -- https://cti.loginsoft.com/ip/94.154.43.197 #Loginsoft #Cytellite #Cybersecurity #CVE202436401 #LOVI #ThreatIntelligence #Infosecurity #AI https://t.co/rQBxBrNSbJ
Post summary
Cytellite reports a recent detection of activity targeting CVE‑2024‑36401, but provides no technical or exploit details, patches, or evidence of in‑the‑wild exploitation.
0000026
23 followersView on X
ismael Liasini@last_snap99948d
Active Exploitation
CISA ha documentado previamente compromisos de GeoServer explotando CVE-2024-36401 poco después de su publicación, y destaca como lección la necesidad de parchear rápidamente vulnerabilidades KEV y ensayar planes de respuesta a incidentes.
Post summary
CISA reports real‑world exploitation of CVE‑2024‑36401 in GeoServer and urges rapid patching of KEV vulnerabilities.
0000065
48 followersView on X
Normunds Aizstrauts@normunds_ai88d
General
@BbisBoss5ozt Ja tas tavs, es sagaidītu references uz cve-2024-36401 uc. šādā incidenta analīzē; plus, ja šis bija mēģinājums, "vadības līmeņa"/vienkāršotu timeline taisīt, tad tur pwr daudz tehnisku detaļu&par maz ietekmes skaidrojuma, bet ir labs ieguldījums )
Post summary
The message references CVE-2024-36401 and expects detailed incident analysis but does not provide or link to a PoC, exploit code, patch, or technical details within the snippet.
0000051
153 followersView on X

CPE platform detail6 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

6 of 6 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	geoserver	geoserver	-	-	-
App	geotools	geotools	-	-	-
App	geotools	geotools	30.0	-	-
App	geotools	geotools	30.0	-	-
App	geotools	geotools	31.0	-	-
App	geotools	geotools	31.0	-	-

Explore more

Back to dashboard geoserver CVEs geotools CVEs geoserver vulnerabilities

What researchers are saying

CVE-2024-36401

DFIR Radar[verified]@DFIR_RadarActive Exploitation

CVE-2024-36401 is actively exploited via XPath injection in GeoServer’s OGC filter, delivering a multi‑stage shell script through a botnet; patching to the latest GeoServer release mitigates the risk.

Renars Kadzulis@RenarsKadzulisGeneral

The post notes two GeoServer CVEs (RCE and XXE) but offers neither proof of exploitation, patches, nor code, merely referencing the vulnerabilities.

Edgars Jēkabsons 🇪🇺 💙💛@edgarsjDisclosure

A link to a Geoserver vulnerability page for CVE-2024-36401 was shared, but the content does not provide detailed technical information, PoC, exploit code, or patch details.

r0otk3r@r0otk3rDisclosure

The tweet announces CVE-2024-36401, highlighting its critical nature and unauthorized RCE impact on GeoServer, hints at a PoC, and urges patching, but provides no direct exploitation code.

Loginsoft Threat Intel@Loginsoft_IntelActive Exploitation

Cytellite reports that Storm Industries LLC has recently detected activity exploiting CVE-2024-36401.

Loginsoft Threat Intel@Loginsoft_IntelGeneral

The tweet references a detection event for CVE-2024-36401 and provides a link, but lacks any technical details, exploit code, or patch information.

Loginsoft Threat Intel@Loginsoft_IntelGeneral

Cytellite reports a recent detection of activity targeting CVE‑2024‑36401, but provides no technical or exploit details, patches, or evidence of in‑the‑wild exploitation.

ismael Liasini@last_snap999Active Exploitation

CISA reports real‑world exploitation of CVE‑2024‑36401 in GeoServer and urges rapid patching of KEV vulnerabilities.