This article details an unpatched zero-day SQL injection vulnerability in GeoServer's jsonArrayContains function that allows unauthenticated attackers to achieve full Remote Code Execution (RCE). It highlights active exploitation attempts, technical indicators of compromise, and provides immediate mitigation guidance including WAF rules and access restrictions. The report is timely and offers actionable intelligence for defenders to protect vulnerable GeoServer instances before an official patch is released.

The content provides detailed, original, and timely threat intelligence on a critical zero-day vulnerability actively exploited in the wild, including technical analysis and practical mitigation steps, making it highly relevant for defenders.

Identify and inventory all GeoServer instances in your environment, restrict public internet access, apply strict Web Application Firewall (WAF) rules to block malicious payloads targeting the jsonArrayContains parameter, and monitor for unusual activity indicative of exploitation attempts. Limit database user privileges to prevent RCE escalation and stay updated on vendor patches and CVE assignments.