GeoServer jsonArrayContains SQL Injection Zero-Day Report: High Volume Probes, Verify PoC RCE Conditions and Differences from Known Vulnerabilities

1. Basic Information

• Severity: Critical
• Article Title: Hackers Exploiting Unpatched GeoServer Zero-Day
• Publisher: SecurityWeek
• Publication Date: 2026-08-14
• Update Date: None
• Original Article: Original Article
• Related Sources:
  • GeoServer OGC Filter Injection Vulnerability Statement (2023-02-20)
  • GeoServer 2.22.2 Release / GEOT-7302 Escape user inputs in SQL queries
• Malware: None
• Groups: None
• CVEs: Unassigned for the 2026 report (at the time of publication). The 2023 OGC Filter SQL injection involving the same jsonArrayContains is CVE-2023-25157 (GeoServer) / CVE-2023-25158 (GeoTools).
• Products: GeoServer, GeoTools, jsonArrayContains filter/function, PostGIS JDBC data store, Oracle JDBC data store

Verification Note: The SecurityWeek article reports the 2026 issue as an unpatched zero-day. Meanwhile, GeoServer already fixed the OGC Filter SQL injection involving jsonArrayContains + PostGIS/Oracle in 2023 under CVE-2023-25157/CVE-2023-25158. A PoC reviewed during this analysis claims SQLi/RCE against PostgreSQL, but the currently verifiable GeoTools implementation includes escape processing for the expected string. It remains unconfirmed whether the 2026 issue is a regression, a different vector, an escape bypass, an unpatched branch/version, or a discrepancy from the PoC description. The PoC itself is not attached or republished in this report or the public article.

2. Executive Summary

SecurityWeek reported a GeoServer SQL injection zero-day via jsonArrayContains and a high volume of probes within hours of its public disclosure. However, this function was already targeted and fixed for SQL injection in 2023, and there are discrepancies between the assumptions of the analyzed PoC and the current GeoTools implementation. Therefore, additional confirmation is required to determine the exact root cause, impacted versions, and RCE conditions of the 2026 issue.

3. Attack Flow

SQL Injection / Probing (SecurityWeek Report)

1. An attacker sends a filter query to a publicly exposed GeoServer endpoint.
2. The attacker passes crafted user arguments to jsonArrayContains.
3. The attacker abuses input processing in the backend JDBC/DB query to attempt SQL injection.
4. The attacker attempts SQL query manipulation, DB data access, and DB behavior changes.
5. WatchTowr observations cited by SecurityWeek show hundreds of exploit attempts from a small number of source IPs within hours of public disclosure.
6. No follow-up compromise after the probes has been confirmed at the time of publication.

Configuration-Dependent RCE on PostgreSQL (Vector Claimed by Analyzed PoC)

1. SQL injection via jsonArrayContains succeeds.
2. Database connection conditions allow stacked queries.
3. The PostgreSQL connection user has high privileges required for server-side program execution.
4. The attack can lead to OS command execution on the database host via SQL features.
5. The execution occurs on the database host side (if PostgreSQL is on a separate host), not on the GeoServer/JVM host.

Blind Data Extraction (Vector Claimed by Analyzed PoC)

1. SQL injection succeeds.
2. Differences in database response time are used as a boolean oracle.
3. The attacker sequentially infers database names, table/column metadata, and allowed table data.
4. The scope of obtainable data depends on the privileges of the database user used by GeoServer.

4. Attacker Position and Execution Location

• The attacker sends requests from the internet to the filter processing functions (such as WFS/WMS) of a public GeoServer instance.
• The SQL injection is executed by the backend database connected from GeoServer, and the impact is limited by the database user privileges.
• The RCE vector in the analyzed PoC assumes PostgreSQL server-side program execution. If successful, the resulting OS process, file, or network activity occurs on the database host.
• Regarding Oracle, SecurityWeek and the 2023 official advisory mention it as a target for jsonArrayContains SQL injection, but the analyzed PoC targets PostgreSQL, and the same RCE vector cannot be generalized to Oracle.

5. Visibility for Victims and Administrators

• No user interaction is required, and attack requests may be received concurrently with normal map and service usage.
• Administrators may observe abnormal filters containing jsonArrayContains, SQL errors, database queries, or long response times.
• If PostgreSQL RCE succeeds, prioritize checking for abnormal processes, file creation, and network connections under the database service, rather than the GeoServer/Java child process.
• A high volume of probes does not mean a successful compromise. Judge HTTP request arrival, SQLi success, database data access, and OS command execution as separate stages.

6. Success and Failure Conditions

Success Conditions

• The target GeoServer/filter endpoint is reachable by the attacker.
• jsonArrayContains and the relevant String/JSON field are available on the target layer/data store.
• Unidentified vulnerability conditions reported in 2026 actually apply to the target version and configuration.
• The scope of readable/updatable data after SQLi is permitted by database user privileges.
• The stacked-query path in the analyzed PoC requires connection conditions that allow multiple statements to execute.
• PostgreSQL RCE in the analyzed PoC requires additional privileges allowing the database user to execute server-side programs.

Failure Conditions

• Isolate GeoServer from the internet and restrict access to trusted networks/VPNs.
• Block abnormal filter inputs using a WAF or API gateway.
• Temporarily remove vulnerable function and data store combinations from public exposure paths.
• Limit metadata/data access, writes, and server-side program execution using database least privilege.
• If the vendor releases a patch or advisory for the 2026 issue, check the affected versions and apply updates quickly.
• Update environments unpatched for the 2023 CVEs (CVE-2023-25157/CVE-2023-25158) to known fixed versions.

7. What Happens on Success

• SQL query manipulation
• Data read/modify within database user privileges
• Potential blind data inference via time-based SQLi
• Potential remote OS command execution on the database host in PostgreSQL configurations meeting the additional conditions assumed by the analyzed PoC
• Hundreds of attempts/probing observed at the time of publication, while follow-on compromises remain unconfirmed

8. Observable Logs

Email

• None related

Proxy / SWG / DNS

• jsonArrayContains filter requests to the GeoServer endpoint
• Abnormal CQL/filter strings containing quotes, comments, or functions
• Repeated requests from the same source
• Unknown egress originating from the database host after RCE success

Endpoint / EDR

• For GeoServer/JVM, check for abnormal terminations, errors, and resource spikes during request processing
• For suspected PostgreSQL RCE, look for unexpected child processes under the database service
• Execution of shells, interpreters, or utilities
• Unexpected file creation on the database host
• Process execution outside normal operations by the database service account

Identity / IdP

• Initial attacks target web filter processing as an entry point, so IdP authentication events alone are insufficient for determination
• GeoServer/database service credential changes and secret access are targets for follow-on investigation

SaaS / Cloud

• WAF/load balancer/API gateway access logs
• GeoServer application logs
• Managed database audit/query logs
• Database service account/role privileges
• Cloud flow logs

Network

• Many requests from a small number of source IPs
• GeoServer to database sessions
• Unexpected outbound traffic from the database host
• Callbacks/scans if a follow-on occurs

9. Attack Success Determination

Contact Only

• Observed GeoServer scans or requests containing jsonArrayContains

User Interaction

• None required

Initial Execution

• Crafted filter requests reached and were processed by the GeoServer application

SQL Injection Success

• Database errors/timing, audit queries, or unintended database side effects support SQLi success
• When relying solely on time-based behavior from the analyzed PoC, separation from network latency is required

RCE Success

• Confirm unexpected child processes under the database service, file creation, or network connections on the PostgreSQL database host
• Do not rely solely on GeoServer/Java child processes as the condition for RCE success

Data Theft / Session Compromise

• Confirm database result/data access, metadata enumeration, and external transmission with separate evidence
• Confirm credential/session access as separate follow-on evidence

Subsequent Compromise Confirmation

• Confirm persistence, internal scans, new accounts, web shells, data modification, and lateral movement

10. Investigation Playbook

Trigger

• Abnormal jsonArrayContains requests
• GeoServer exposure reported in SecurityWeek
• SQL errors or timing spikes
• Unexpected child processes under the database service

Initial Confirmation

• Determine GeoServer/GeoTools version, data stores, public exposure, target layers/fields, and first requests/sources
• Check application status of patches for 2023 vulnerabilities CVE-2023-25157/CVE-2023-25158
• Review HTTP requests/responses, GeoServer logs, and database audit/query logs with time synchronization
• Check PostgreSQL prepared statement settings and database user roles/privileges, while treating impact on the 2026 issue as unconfirmed

Endpoint

• Preserve GeoServer/JVM process trees, application logs, temp/web directories, and sockets
• For separate database hosts, prioritize preserving database process trees, service accounts, file integrity, and sockets

Authentication / Cloud

• Privileges of GeoServer-to-database credentials
• PostgreSQL role membership and server-side program execution capabilities
• Check secret access, managed database audits, and control-plane changes

Subsequent Operations

• Database query/data access, metadata enumeration
• Callbacks from the database host
• New users, scheduled tasks, web shells, and lateral movement
• Data modification/exfiltration

Containment

• Restrict public access
• Apply WAF virtual patches
• Stop public exposure paths for vulnerable functions and data stores
• Implement database least privilege
• Rotate database credentials if necessary
• If RCE evidence exists, isolate the affected database host and decide whether to rebuild

Determination Categories

• Scanned
• Exploit Attempted
• SQL Injection Suspected
• SQL Injection Confirmed
• Data Access Confirmed
• RCE Confirmed
• Follow-on Compromise Confirmed

11. Defense and Detection Ideas

Single Events

• jsonArrayContains combined with SQL metacharacters or comments
• GeoServer SQL errors
• Database query latency anomalies
• Database service to unexpected child process
• Database host to unexpected outbound traffic

Time-Series Correlation

• Crafted filter -> GeoServer/database error or timing anomaly -> abnormal database query -> database child process/file -> outbound traffic
• Crafted filter -> repeated timing requests -> metadata/data access evidence

Threat Hunting Perspectives

• Public GeoServer inventory
• GeoServer/GeoTools versions and application status of 2023 OGC Filter SQLi patches
• Use of PostGIS or Oracle
• Layers and JSON fields utilizing jsonArrayContains
• Source concentration after disclosure
• New processes, files, or network activities by PostgreSQL service users
• Database roles with server-side program execution privileges

Log Gaps

• HTTP queries/bodies
• GeoServer filter/application logs
• Database audit/query logs
• Database process lineage
• Database service role/privilege snapshots
• Egress traffic

Priority Countermeasures

• Reduce external exposure
• Apply WAF virtual patches
• Verify application of known 2023 fixed versions
• Implement database least privilege
• Database host EDR/process monitoring
• Monitor vendor advisories/patches for the 2026 issue

12. Facts / Inference / Hypothesis

Facts

• SecurityWeek reported an unpatched GeoServer SQL injection zero-day via jsonArrayContains on 2026-08-14.
• Information referenced by existing reports from SecurityWeek states that WatchTowr observed hundreds of exploit attempts from a small number of source IPs within hours of disclosure, with no follow-on activity confirmed at the time of publication.
• GeoServer officially announced in 2023 that using jsonArrayContains with String/JSON fields and PostGIS/Oracle DataStores introduced SQL injection vulnerabilities tracked as CVE-2023-25157/CVE-2023-25158.
• The 2023 issues were fixed in GeoServer 2.22.2, 2.21.4, 2.20.7, 2.19.7, 2.18.7, etc., and GEOT-7302 introduced SQL escaping for user input.
• The analyzed PoC implements time-based SQLi, stacked queries, database metadata/data extraction, and OS command execution via server-side program execution (when extra privileges are present) targeting PostgreSQL.
• The analyzed PoC assumes disabled prepared statements for its SQL/RCE modes using stacked queries, and requires PostgreSQL superuser or equivalent pg_execute_server_program privileges for OS command execution.
• Currently verifiable GeoTools PostGIS FilterToSqlHelper.constructEquality() applies escapeJsonLiteral() to the expected string, and EscapeSql.escapeLiteral() escapes single quotes and similar characters.
• The statement at the beginning of the analyzed PoC claiming "expected is written raw to SQL and only JSON pointers are escaped" does not match current verifiable GeoTools code.
• RCE via H2 cannot be confirmed from the analyzed PoC.

Inference

• If the 2026 report is correct, there may be a code path different from the 2023 fix, a regression, an escape bypass, or a specific version/branch/configuration issue, but it cannot be identified at this time.
• HTTP requests alone cannot determine SQLi/RCE success; correlation with GeoServer logs, database audit/query logs, and database host processes/network activity is required.
• Focusing solely on GeoServer/Java child processes when detecting RCE may cause analysts to miss the database host RCE assumed by the analyzed PoC.

Hypothesis

• The high volume of probes in 2026 may be a reuse of known 2023 PoCs, a new 2026 bypass, or a mixture of both. Public information alone cannot distinguish them.
• It is possible that this could evolve into follow-on payloads similar to past GeoServer mass exploitation campaigns, but no such follow-on compromise has been confirmed at the time of the SecurityWeek report.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application — Confidence: High
• T1059 Command and Scripting Interpreter — Confidence: Medium (If OS command execution succeeds on the database host)
• T1213 Data from Information Repositories — Confidence: Medium (If database data access is confirmed)
• T1046 Network Service Discovery — Confidence: Low (Only if follow-on internal scans are confirmed)
• T1505.003 Web Shell — Confidence: Low (Not confirmed in current reports/PoCs; kept as a follow-on investigation perspective)

14. Unknowns and Additional Investigation

• CVE identifiers for the 2026 issue, affected GeoServer/GeoTools versions, official vendor advisories, and patch ETAs
• The root cause and exact vulnerable code path that led SecurityWeek/WatchTowr to judge this as a 2026 zero-day
• Technical differences from the 2023 CVE-2023-25157/CVE-2023-25158 vulnerabilities
• Exact GeoServer/GeoTools versions and commits targeted by the analyzed PoC
• The reason for the discrepancy between the PoC's description of raw expected and the current escapeJsonLiteral() implementation
• Whether the 2026 issue succeeds when prepared statements are enabled
• 2026-specific exploit paths applicable to Oracle and impact conditions equivalent to the PostgreSQL PoC
• Complete source IPs and IOCs
• Real victims where SQLi/RCE success has been confirmed
• Follow-on payloads, actors, and data impact

15. Impact on SOCs and General Organizations

Organizations exposing GeoServer should not automatically assume RCE based solely on 2026 zero-day reports. Instead, they should first inventory internet exposure, GeoServer/GeoTools versions, the application status of 2023 OGC Filter SQLi fixes, PostGIS/Oracle usage, and whether jsonArrayContains is utilized. Security Operations Centers (SOCs) must separate HTTP probes from successful compromises by incorporating database audit logs and database host process/network telemetry. Until vendors release official advisories for the 2026 issue, prioritize network restrictions, WAFs, and database least privilege.

16. Summary by Role

• For SOCs: Do not judge compromises based on jsonArrayContains requests alone. Correlate HTTP -> GeoServer -> database queries -> database host processes/network activity. The PoC-assumed RCE targets the database host, so do not rely solely on Java child processes.
• For Administrators: Verify the version, data stores, and 2023 patch status of public GeoServer instances. Reduce public exposure scopes, deploy WAFs, and enforce database least privilege until a 2026 advisory is confirmed.
• For End Users: No user action is required. End users cannot take mitigating actions themselves; report any anomalies or service outages in mapping applications to administrators.