Critical GeoServer Vulnerability CVE-2024-36401 Actively Exploited for Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2024-36401 in GeoServer is being actively exploited in the wild, enabling unauthenticated remote code execution that can result in full server takeover.
The issue stems from the way GeoServer and its underlying GeoTools library evaluate certain property names. In default configurations these parameters can be processed as XPath expressions, allowing malicious payloads to trigger code execution via the commons-jxpath library.
Attackers can abuse multiple OGC services to reach the vulnerable code path. Affected request types include WFS operations such as GetFeature and GetPropertyValue, WMS calls including GetMap, GetFeatureInfo and GetLegendGraphic, as well as WPS Execute requests. Any internet-facing instance publishing these endpoints is at immediate risk.
Observed attack chains follow a familiar pattern: initial compromise via the CVE-2024-36401 exploit, network reconnaissance, lateral movement, and persistence through web shells. One frequently deployed tool is the China Chopper web shell, valued by attackers for its simplicity and resilience after service restarts.
Official fixes are already available. Patched releases include GeoServer 2.22.6, 2.23.6, 2.24.4 and 2.25.2. Administrators should update without delay and assume any previously exposed, unpatched instance may be compromised.
When patching cannot be completed immediately, a temporary mitigation involves removing the gt-complex JAR file from the deployment. This step reduces the attack surface but may disable required functionality or prevent service startup; testing in a staging environment is strongly advised.
Additional hardening measures include limiting access by IP address, enforcing VPN connectivity, deploying an authenticating reverse proxy, and continuously reviewing GeoServer and web-server logs for suspicious WFS, WMS and WPS requests containing unusual filter parameters.
Related articles
CTEM Without the Hype: Understanding Gartner's Continuous Threat Exposure Management Framework
The article explains the evolution of vulnerability management from basic scheduled scanning to risk-based approaches and finally to Continuous Threat Exposure Management (CTEM). It positions CTEM as a comprehensive program introduced by Gartner in 2022 that integrates asset management, EASM, CAASM, automated pentesting, and business-context prioritization. The five-stage cycle of Scoping, Discovery, Prioritization, Validation, and Mobilization is detailed with practical examples such as protecting customer databases in an e-commerce environment. Gartner predicts organizations prioritizing CTEM will suffer three times fewer breaches by 2026, though only 16% have reached operational maturity. The piece also covers common implementation pitfalls and the emergence of the first Magic Quadrant for Exposure Assessment Platforms featuring vendors like Tenable, Qualys, and Rapid7.
Microsoft Patches Over 1,400 Vulnerabilities in October 2026 Security Update, Some Already Exploited
Microsoft released its October 2026 Patch Tuesday updates on October 13, 2026, addressing a total of 1,407 CVEs plus one additional advisory. The update covers a wide range of issues including 315 remote code execution flaws, 673 privilege escalation vulnerabilities, and 252 information disclosure problems. Severity ratings show 78 vulnerabilities classified as Critical and 1,329 as Important. Several of the addressed flaws have already been confirmed as exploited in the wild. The release aligns with the regular second Tuesday of the month schedule for coordinated vendor patching. Related security advisories from other vendors were also highlighted in the same reporting cycle.
Google Chrome Update Patches 37 Vulnerabilities Including Seven Critical Flaws
Google has released a security update for its Chrome browser that addresses 37 vulnerabilities across Windows, macOS, and Linux platforms. Seven of the issues are rated Critical, the highest severity level, while 29 are rated High and one is rated Medium. The update brings Chrome to versions 155.0.8059.80 on Windows and macOS and 155.0.8059.79 on Linux and macOS. Among the critical fixes is a buffer overflow in the ANGLE graphics component tracked as CVE-2026-110152, plus six Use After Free flaws affecting Browser, PDF, Network, Core, SVG, and Media components. The High-severity issues primarily involve Use After Free problems in V8, WebRTC, PDF, DOM, and Media. The single Medium issue is also included in the advisory.
Ivanti Connect Secure VPN Hit by Zero-Day Authentication Bypass Vulnerability CVE-2026-104935
Ivanti has disclosed a critical authentication bypass vulnerability in its Ivanti Connect Secure remote access product that allows remote attackers to execute arbitrary commands without authentication. The flaw, tracked as CVE-2026-104935, carries a CVSSv3.0 base score of 8.6 and has already been exploited in the wild against certain customer environments. Affected versions include 25.1.2.2, 25.1.1.1, and 22.8R2.4 along with earlier releases in those branches, while versions 22.7R2.14 and prior remain unaffected. Ivanti discovered the issue through its product security program and released the fix in version 25.1.3.0 during July. The company published its security advisory on October 13, 2026, confirming active exploitation of the zero-day in unpatched branches.