Critical GeoServer Vulnerability CVE-2024-36401 Actively Exploited for Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2024-36401 in OSGeo GeoServer is being actively exploited in the wild and can lead to unauthenticated remote code execution. The issue affects organizations and government agencies that publish geospatial data through GeoServer instances exposed to the internet.
The root cause lies in the way GeoServer and its supporting GeoTools library evaluate certain property names. In default setups, specific parameters are interpreted as XPath expressions, enabling attackers to craft malicious payloads that trigger code execution through the commons-jxpath library.
Multiple service endpoints are impacted. Attackers can target WFS requests such as GetFeature and GetPropertyValue, WMS functions including GetMap, GetFeatureInfo and GetLegendGraphic, as well as WPS Execute operations. Any internet-facing deployment publishing these endpoints is at immediate risk.
Documented incidents show a clear attack chain: initial access via the vulnerability, internal reconnaissance, lateral movement and persistence through web shells. One tool repeatedly observed is China Chopper, valued by adversaries for its simplicity and resilience after service restarts.
Official fixes have been released in GeoServer versions 2.22.6, 2.23.6, 2.24.4 and 2.25.2. Administrators should update without delay and treat any previously exposed instance as potentially compromised.
When patching cannot be completed immediately, a mitigation is to remove the gt-complex x.y.jar file from the deployment. This step reduces the attack surface but may disable required functionality and should be tested first in a staging environment.
Additional defensive measures include restricting access by IP address, enforcing VPN connections, deploying an authenticated reverse proxy and continuously monitoring logs for anomalous WFS, WMS and WPS requests. After remediation, teams must search for web shells, unexpected processes and unusual outbound connections while rotating associated credentials.
Related articles
GitLab Releases Security Updates Fixing 11 Vulnerabilities Including Two Critical Flaws
GitLab has issued critical security updates for its development platform to address 11 vulnerabilities across Community Edition and Enterprise Edition. The patches cover versions 19.4.1, 19.3.3, and 19.2.7 and were released on September 23, 2026. Two vulnerabilities rated Critical allow authenticated users to achieve arbitrary code execution on the server. CVE-2026-89078 involves a double-free issue in CI/CD configuration parsing triggered by crafted regular expressions, while CVE-2026-93577 is an integer overflow in the regular expression compiler. Additional High-severity issues include cross-site scripting in merge request diffs and unauthorized access to sensitive CI/CD variables via the Duo AI job troubleshooting feature. The update also resolves five Medium and two Low severity flaws.
Google Releases Chrome 154 with 108 Security Fixes Including 11 Critical Vulnerabilities
Google has published Chrome 154 for Windows, macOS, and Linux, addressing a total of 108 vulnerabilities. Eleven of these issues are rated Critical, covering buffer overflows in ANGLE, out-of-bounds writes in GPU, and multiple Use-After-Free flaws in ServiceWorker, Fullscreen, WindowDialog, AdFilter, and WebGL. Twenty-five High-severity issues were also fixed, including authorization problems in extensions, improper UI rendering in SecurityIndicators, and race conditions plus type confusion in the V8 JavaScript engine. Additional Medium and Low severity fixes bring the total to 108 patched flaws across components such as PDFium and WebAudio. The update is being rolled out over the coming days and weeks. Specific CVEs addressed include CVE-2026-95350, CVE-2026-95357, and CVE-2026-95281.
WordPress Patches Critical Core Vulnerability CVE-2026-87902 Affecting All Versions from 4.7.0
WordPress has released patches for a critical vulnerability in the platform's core code, tracked as CVE-2026-87902 with a CVSS score of 9.2. The flaw impacts every version from 4.7.0 through 7.1.1, meaning virtually all unpatched installations remain exposed. Because the issue resides in the base system rather than plugins or themes, even sites without any extensions installed are at risk. The vulnerability allows an unauthenticated attacker to load arbitrary PHP files from outside theme directories, which can lead to remote code execution on certain server configurations. The bug was privately reported in July by researcher Robert Ressl through HackerOne and disclosed publicly on 22 September, with no confirmed exploitation observed so far. Administrators are urged to apply the updates immediately and keep automatic updates enabled.
Critical Microsoft SharePoint Vulnerability Allows Remote Code Execution via SafeControls Bypass
A vulnerability tracked as CVE-2026-65660 with a CVSS score of 8.8 affects Microsoft SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. The flaw permits an authenticated low-privileged attacker to achieve arbitrary code execution on on-premises servers. It stems from improper handling of quotes in attacker-controlled Register directives within the ToolPane component, bypassing the SafeControls mechanism. This allows registration of dangerous .NET classes followed by deserialization-based remote code execution. Microsoft released patches on August 11, 2026, and initially reported no public disclosure or exploitation. Publication of a detailed technical analysis has now increased the risk for unpatched installations.