--- title: Attackers target zero-day vulnerability in geospatial... description: Attackers are actively probing a newly disclosed, unpatched zero-day SQL injection vulnerability in GeoServer's jsonArrayContains function, which lets... canonical: https://daily.dev/posts/attackers-target-zero-day-vulnerability-in-geospatial-data-platform-geoserver-8wtfvoytx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Attackers target zero-day vulnerability in geospatial data platform GeoServer | daily.dev og:description: Attackers are actively probing a newly disclosed, unpatched zero-day SQL injection vulnerability in GeoServer's jsonArrayContains function, which lets... og:url: https://daily.dev/posts/attackers-target-zero-day-vulnerability-in-geospatial-data-platform-geoserver-8wtfvoytx og:image: https://api.daily.dev/og/posts/8WtFVoyTX.png og:image:alt: Attackers target zero-day vulnerability in geospatial data platform GeoServer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Attackers target zero-day vulnerability in geospatial data platform GeoServer **[CSO Online](https://daily.dev/sources/csoonline)** · 2 min read · 0 upvotes · 0 comments ## Summary Attackers are actively probing a newly disclosed, unpatched zero-day SQL injection vulnerability in GeoServer's jsonArrayContains function, which lets unauthenticated users inject SQL commands. On Microsoft SQL Server configurations where the database account has admin permissions, the flaw can escalate to remote code execution. WatchTowr researchers observed hundreds of exploitation attempts from a small number of source IPs within hours of public disclosure on X, though so far the attempts appear to be reconnaissance probes rather than active payload delivery. GeoServer has been targeted before due to its high-value user base in government, defense, and research sectors. Until a patch ships, organizations should identify internet-exposed instances, restrict public access, and review logs for signs of prior exploitation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GeoServer jsonArrayContains SQL injection zero-day? It is an unauthenticated SQL injection vulnerability in GeoServer's jsonArrayContains function, disclosed publicly on X by a bug bounty hunter. Unauthenticated users can inject SQL commands into the underlying database. On non-default configurations where the database runs with administrator permissions on Microsoft SQL Server, the flaw can escalate to remote code execution. No official patch exists yet. _Teams tracking active exploitation of unpatched flaws like this follow security advisories on daily.dev._ ### Is the GeoServer zero-day SQL injection being actively exploited? Yes, watchTowr researchers recorded hundreds of exploitation attempts within hours of the vulnerability's public disclosure, originating from a small number of source IP addresses. The attempts observed so far look like probes to identify vulnerable instances rather than delivery of malicious payloads or commands, though that could change given GeoServer's history of exploitation. _Security teams monitoring fast-moving exploitation of newly disclosed flaws follow updates like this on daily.dev._ ### How can I protect my GeoServer instance from the unpatched jsonArrayContains SQL injection flaw? Since no patch is available yet, identify any internet-exposed GeoServer instances and restrict public access to them. Also review server logs for signs that exploitation attempts have already succeeded, since attackers began probing within hours of the flaw's public disclosure on X. _Admins hardening exposed services against unpatched flaws track mitigation guidance like this on daily.dev._ ## Similar posts on daily.dev - [Inside an Oracle Database SQL Injection Attack](https://daily.dev/posts/inside-an-oracle-database-sql-injection-attack-jmtkujhqh) · Huntress Blog · 0 upvotes · 0 comments - [Drupal: Critical SQL injection flaw now targeted in attacks](https://daily.dev/posts/drupal-critical-sql-injection-flaw-now-targeted-in-attacks-eovujytlt) · BleepingComputer · 0 upvotes · 0 comments - [Drupal admins rushing to patch maximum severity SQL injection vulnerability](https://daily.dev/posts/drupal-admins-rushing-to-patch-maximum-severity-sql-injection-vulnerability-m8ndbi0q2) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/attackers-target-zero-day-vulnerability-in-geospatial-data-platform-geoserver-8wtfvoytx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Attackers target zero-day vulnerability in geospatial data platform GeoServer","url":"https://daily.dev/posts/attackers-target-zero-day-vulnerability-in-geospatial-data-platform-geoserver-8wtfvoytx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/attackers-target-zero-day-vulnerability-in-geospatial-data-platform-geoserver-8wtfvoytx"},"datePublished":"2026-08-13T20:46:18.922Z","dateModified":"2026-08-24T08:22:36.793Z","description":"Attackers are actively probing a newly disclosed, unpatched zero-day SQL injection vulnerability in GeoServer's jsonArrayContains function, which lets...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/688bc6bc289ee7199ca5a3515c86753c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/688bc6bc289ee7199ca5a3515c86753c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/attackers-target-zero-day-vulnerability-in-geospatial-data-platform-geoserver-8wtfvoytx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,zero-day","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Attackers target zero-day vulnerability in geospatial data platform GeoServer"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/attackers-target-zero-day-vulnerability-in-geospatial-data-platform-geoserver-8wtfvoytx#faq","mainEntity":[{"@type":"Question","name":"What is the GeoServer jsonArrayContains SQL injection zero-day?","acceptedAnswer":{"@type":"Answer","text":"It is an unauthenticated SQL injection vulnerability in GeoServer's jsonArrayContains function, disclosed publicly on X by a bug bounty hunter. Unauthenticated users can inject SQL commands into the underlying database. On non-default configurations where the database runs with administrator permissions on Microsoft SQL Server, the flaw can escalate to remote code execution. No official patch exists yet. Teams tracking active exploitation of unpatched flaws like this follow security advisories on daily.dev."}},{"@type":"Question","name":"Is the GeoServer zero-day SQL injection being actively exploited?","acceptedAnswer":{"@type":"Answer","text":"Yes, watchTowr researchers recorded hundreds of exploitation attempts within hours of the vulnerability's public disclosure, originating from a small number of source IP addresses. The attempts observed so far look like probes to identify vulnerable instances rather than delivery of malicious payloads or commands, though that could change given GeoServer's history of exploitation. Security teams monitoring fast-moving exploitation of newly disclosed flaws follow updates like this on daily.dev."}},{"@type":"Question","name":"How can I protect my GeoServer instance from the unpatched jsonArrayContains SQL injection flaw?","acceptedAnswer":{"@type":"Answer","text":"Since no patch is available yet, identify any internet-exposed GeoServer instances and restrict public access to them. Also review server logs for signs that exploitation attempts have already succeeded, since attackers began probing within hours of the flaw's public disclosure on X. Admins hardening exposed services against unpatched flaws track mitigation guidance like this on daily.dev."}}]} ```