Vulnerability intelligence

CVE-2024-36401

OSGeo GeoServer GeoTools Eval Injection Vulnerability

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to ALL GeoServer instances.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

100%

Riskier than 100% of all CVEs · checked 2026-09-05

Exploitation

Confirmed in the wild

KEV since 2024-07-15

Remediation

Patch available

Federal deadline 2024-08-05

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2024-08-05.

NVD entry Vendor patch PoC / advisory CISA KEV

1 article across 1 outlet · first covered Jul 22, 2026 · latest Jul 22, 2026

Associated threat actors

Rondo botnet

Coverage timeline

Rondo botnet revives Geoserver flaw, exploiting CVE-2024-36401
isc.sans.edu · Jul 22, 2026