CISA KEV Critical Injection exploit reference

CVE-2024-36401 — OSGeo GeoServer GeoTools Eval Injection Vulnerability

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

Published Jul 1, 2024 · Updated Oct 13, 2026 · Sources: CISA Known Exploited Vulnerabilities, NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP, GitHub Security Advisories · CNA: GitHub_M

Urgent

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

CISA KEV · Jul 15, 2024 Detection templates (Nuclei) · 1 Metasploit modules · 1 Proofs of concept on GitHub · 22

How the score was calculated

Confirmed exploitation (CISA KEV)+35
Public exploit/PoC (nuclei, metasploit, github)+20
EPSS 99.8% (30-day exploitation probability)+15
Technical severity (critical)+10
Automatable exploitation (SSVC)+3

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Confirmed

CISA KEV, listed Jul 15, 2024

EPSS FIRST

99.81%

ahead of 100% of scored CVEs · Oct 14, 2026

Affects

Geoserver

Geoserver and 4 more

CVSS base

9.8

Critical · 4 source(s)

CISA SSVC assessment CISA

Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.

Exploitation

Active

none · proof-of-concept · active

Automatable

Yes

can an attacker script the kill-chain steps

Technical impact

Total

partial · total control of the vulnerable component

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

Documented mitigation — github.com (NIST National Vulnerability Database)
Documented patch — github.com (NIST National Vulnerability Database)
Maven Org.geoserver.web:gs-web-app: fixed in version 2.24.4 — github.com (GitHub Security Advisories)
Maven Org.geoserver.web:gs-web-app: fixed in version 2.25.2 — github.com (GitHub Security Advisories)
Maven Org.geoserver.web:gs-web-app: fixed in version 2.23.6 — github.com (GitHub Security Advisories)
Maven Org.geoserver.web:gs-web-app: fixed in version 2.22.6 — github.com (GitHub Security Advisories)
Maven Org.geoserver:gs-wfs: fixed in version 2.24.4 — github.com (GitHub Security Advisories)
Maven Org.geoserver:gs-wfs: fixed in version 2.25.2 — github.com (GitHub Security Advisories)
Maven Org.geoserver:gs-wfs: fixed in version 2.23.6 — github.com (GitHub Security Advisories)
Maven Org.geoserver:gs-wfs: fixed in version 2.22.6 — github.com (GitHub Security Advisories)
Maven Org.geoserver:gs-wms: fixed in version 2.24.4 — github.com (GitHub Security Advisories)
Maven Org.geoserver:gs-wms: fixed in version 2.25.2 — github.com (GitHub Security Advisories)
Maven Org.geoserver:gs-wms: fixed in version 2.23.6 — github.com (GitHub Security Advisories)
Maven Org.geoserver:gs-wms: fixed in version 2.22.6 — github.com (GitHub Security Advisories)

CISA required action CISA

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

US federal deadline: Aug 5, 2024 — passed 801 day(s) ago

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Geoserver Geoserver, Geotools Geotools, Maven Org.geoserver:gs-wfs…).
Treat as emergency remediation: the CVE is in CISA KEV (confirmed exploitation).
The attack is network-based and needs no privileges: restrict exposure (ACLs, VPN, WAF) until patched.
Apply the fixed version or the patch documented under Remediation.
EPSS ahead of 100% of scored CVEs: prioritize it in the patch queue.
Search available logs for exploit probes matching the vulnerability class (injection), errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Geoserver	Geoserver	≥ 2.23.0 and < 2.23.6≥ 2.24.0 and < 2.24.4≥ 2.25.0 and < 2.25.2< 2.22.6	Vulnerable	NIST National Vulnerability Database
Geoserver	Geoserver	version >= 2.23.0, < 2.23.6version >= 2.24.0, < 2.24.4version >= 2.25.0, < 2.25.2version < 2.22.6	Vulnerable	CVE Program (cve.org) e CISA ADP
Geotools	Geotools	version 31.0version 31.0-rcversion 30.0-rcversion 30.0≥ 31.1 and < 31.2≥ 30.1 and < 30.4< 29.6	Vulnerable	NIST National Vulnerability Database
Maven	Org.geoserver:gs-wfs	≥ 2.24.0 and < 2.24.4≥ 2.25.0 and < 2.25.2≥ 2.23.0 and < 2.23.6< 2.22.6	Vulnerable	GitHub Security Advisories
Maven	Org.geoserver:gs-wms	≥ 2.24.0 and < 2.24.4≥ 2.25.0 and < 2.25.2≥ 2.23.0 and < 2.23.6< 2.22.6	Vulnerable	GitHub Security Advisories
Maven	Org.geoserver.web:gs-web-app	≥ 2.24.0 and < 2.24.4≥ 2.25.0 and < 2.25.2≥ 2.23.0 and < 2.23.6< 2.22.6	Vulnerable	GitHub Security Advisories

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
9.8	CVSS 3.1	Critical	3.9	5.9	security-advisories@github.com via NIST National Vulnerability Database
9.8	CVSS 3.1	Critical	3.9	5.9	nvd@nist.gov via NIST National Vulnerability Database
9.8	CVSS 3.1	Critical	—	—	GitHub, Inc. via GitHub Security Advisories
9.8	CVSS 3.1	Critical	—	—	GitHub_M via CVE Program (cve.org) e CISA ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (score shown at the top: nvd@nist.gov)

Weakness MITRE

Weakness class according to MITRE’s CWE catalog.

CWE-94 · Code Injection

Other CVEs with this weakness →

CISA KEV details CISA

CISA lists a CVE once it has evidence of exploitation against real targets.

Listed

Jul 15, 2024

Federal deadline

Aug 5, 2024

passed 801 day(s) ago

Ransomware use

Unknown

CISA records ransomware use only for campaigns it has confirmed, so “Unknown” means unrecorded, not ruled out. The deadline binds US federal agencies; for everyone else it is a reference date.

Public exploits, PoCs and detection templates

Public code that demonstrates or tests the flaw raises the odds of mass exploitation — and Nuclei templates help find vulnerable assets in your environment.

Detection templates (Nuclei)

GeoServer RCE in Evaluating Property Name Expressions

Metasploit modules

Geoserver unauthenticated Remote Code Execution excellent Jul 1, 2024

Proofs of concept on GitHub — 22 repositories; showing the 10 most starred

GeoServer（CVE-2024-36401/CVE-2024-36404）漏洞利用工具 ★ 123 Jan 7, 2025
GeoServer Remote Code Execution ★ 89 Jul 30, 2024
Remote Code Execution (RCE) Vulnerability In Evaluating Property Name Expressions with multies ways to exploit ★ 56 Jul 6, 2024
geoserver CVE-2024-36401漏洞利用工具 ★ 45 Jul 17, 2024
CVE-2024-36401 图形化利用工具，支持各个JDK版本利用以及回显、内存马实现 ★ 43 Apr 11, 2025
POC for CVE-2024-36401. This POC will attempt to establish a reverse shell from the vlun targets. ★ 35 Jul 4, 2024
POC ★ 4 Jul 5, 2024
Mass scanner for CVE-2024-36401 ★ 4 Aug 27, 2024
Proof-of-Concept Exploit for CVE-2024-36401 GeoServer 2.25.1 ★ 3 Sep 13, 2024
CVE-2024-36401 (GeoServer Remote Code Execution) ★ 2 Nov 27, 2024

Warning: public PoCs are sometimes disguised malware. Use them only for authorized testing in an isolated environment. This portal does not host exploit code — it only points to the sources.

EPSS over time FIRST

Oct 12, 2026 → Oct 14, 2026 · 3 reading(s) · max 99.81%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).
Look for parameters with command/query metacharacters and unexpected child processes of the service.
Hunt retroactively in logs from before Jul 15, 2024 (KEV listing): exploitation may have started earlier.

web/proxy/WAF logsnetwork IDS/IPSapplication logsendpoint telemetry (EDR)

Timeline

What happened to this CVE, newest first.

2026
Fix documented
Oct 13, 2026 · GitHub Security Advisories
Affected products added · maven/org.geoserver.web:gs-web-app, maven/org.geoserver:gs-wfs, maven/org.geoserver:gs-wms
Oct 13, 2026 · GitHub Security Advisories
Affected products added · geoserver/geoserver
Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
SSVC assessment updated
Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
Record published
Oct 13, 2026
Fix documented
Oct 13, 2026 · NIST National Vulnerability Database
Affected products added · geoserver/geoserver, geotools/geotools
Oct 13, 2026 · NIST National Vulnerability Database
CVSS changed · 9.8
Oct 13, 2026 · NIST National Vulnerability Database
Source status changed · → Analyzed
Oct 13, 2026 · NIST National Vulnerability Database
Added to CISA KEV (detected)
Oct 13, 2026 · CISA Known Exploited Vulnerabilities
Record created in this database
Oct 13, 2026 · CISA Known Exploited Vulnerabilities
2024
Added to CISA KEV catalog
Jul 14, 2024 · CISA
CVE published
Jul 1, 2024 · GitHub_M

Source activity

Repeated readings are counted rather than listed.

2× References added · Oct 13, 2026 – Oct 13, 2026
1× Official description updated · Oct 13, 2026 – Oct 13, 2026

References

9 on the record

osgeo-org.atlassian.net/browse/GEOT-7587
Vendor Advisory, x_refsource_MISC, NIST National Vulnerability Database
github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
Exploit, Vendor Advisory, x_refsource_MISC, NIST National Vulnerability Database
github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
Mitigation, Vendor Advisory, x_refsource_CONFIRM, NIST National Vulnerability Database
github.com/geotools/geotools/pull/4797
Issue Tracking, Patch, x_refsource_MISC, NIST National Vulnerability Database
www.cisa.gov/known-exploited-vulnerabilities-catalog
US Government Resource, NIST National Vulnerability Database
www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401
Exploit, Third Party Advisory, NIST National Vulnerability Database
github.com/advisories/GHSA-6jj6-gm7p-fcvv
GitHub Security Advisories
nvd.nist.gov/vuln/detail/CVE-2024-36401
GitHub Security Advisories
github.com/Warxim/CVE-2022-41852
Exploit, Third Party Advisory, x_refsource_MISC, NIST National Vulnerability Database

Elsewhere on this site

Geoserver
every CVE for this vendor

2024-07
what else CISA listed that month

Injection
same class

CWE-94
other pages naming this weakness

Related CVEs (same products)

Critical CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers Aug 21, 2026
Medium CVE-2025-21621 GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format Nov 25, 2025
Critical CVE-2025-58360 OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability KEV Nov 25, 2025

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2024-36401 is "OSGeo GeoServer GeoTools Eval Injection Vulnerability", rated Critical. It affects Geoserver (Geoserver); versions are in the scope table. It is in CISA KEV: there is evidence of real-world exploitation. CVSS 9.8 describes technical severity. EPSS 99.81% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.