CVE Radar

CVE Radar Logo
CVERadar

Edition used by more than 30,000 companies in more than 150 countries.
Sign Up For Free

CVE-2024-36401

Critical Severity|Geoserver
92
SVRS
9.8
CVSSv3
0.99787
EPSS
TAGS
In The WildExploit AvaliableCISA KEVExploit Available
VECTOR STRING
CVSS:3.1AV:NAC:LPR:NUI:NS:UC:HI:HA:H
PUBLICATION DATE2024-07-01
LAST MODIFIED2025-10-21

Deep CVE Analysis in Progress

The system is currently conducting an in-depth analysis of the selected CVE. This includes advanced correlation, vulnerability classification, and cross-referencing with real-time threat intelligence sources. Once the analysis is complete, the page will automatically update with enriched vulnerability data and actionable insights.

Security Intelligence Brief

1. What is this vulnerability and why does it matter?
This vulnerability, identified as CVE-2024-36401, affects GeoServer, an open-source server for sharing and editing geospatial data. It allows for unauthenticated Remote Code Execution (RCE) due to insecure evaluation of property names as XPath expressions. This is critical because it enables an unauthenticated attacker to execute arbitrary code on the server, potentially leading to full system compromise, data theft, service disruption, or further network penetration. The vulnerability impacts all GeoServer instances, making it a widespread and severe threat.
2. What are the CVSS score, severity level, and disclosure details?
The CVSS score for this vulnerability is 9.8, which translates to a Critical severity level. The vulnerability was published on 2024-07-01 15:25:41 UTC and last modified on 2025-10-21 22:56:21 UTC.
3. Which products, vendors, systems, and versions are affected?
This vulnerability affects GeoServer, an open-source product. Specifically, all versions of GeoServer prior to the following patched releases are vulnerable:
  • 2.22.6
  • 2.23.6
  • 2.24.4
  • 2.25.2
The vulnerability applies to all GeoServer instances regardless of their specific configuration, as the underlying issue incorrectly affects simple feature types in addition to complex ones.
4. What is the technical root cause and attack vector?
The technical root cause lies within the GeoTools library API, which GeoServer utilizes. This library evaluates property/attribute names for feature types in a way that unsafely passes them to the `commons-jxpath` library. The `commons-jxpath` library can execute arbitrary code when evaluating XPath expressions. While this XPath evaluation is intended only for complex feature types (e.g., Application Schema data stores), it is incorrectly applied to simple feature types as well, making virtually all GeoServer installations susceptible. The attack vector involves sending specially crafted OGC request parameters to a vulnerable GeoServer instance.
5. How can this vulnerability be exploited?
This vulnerability can be exploited by unauthenticated users through specially crafted input against a default GeoServer installation. The exploitation occurs by sending malicious XPath expressions embedded within OGC request parameters. No public Proof of Concept (PoC) is explicitly provided in the CVE data, but it has been confirmed that this vulnerability is exploitable through the following OGC request types:
  • WFS GetFeature
  • WFS GetPropertyValue
  • WMS GetMap
  • WMS GetFeatureInfo
  • WMS GetLegendGraphic
  • WPS Execute requests
Attackers can leverage these requests to achieve arbitrary code execution on the underlying server.
6. What mitigation steps and patches are available?
The primary mitigation is to upgrade GeoServer to a patched version. The following versions contain a fix for this issue:
  • 2.22.6
  • 2.23.6
  • 2.24.4
  • 2.25.2
As a workaround, if immediate patching is not possible, administrators can remove the `gt-complex-x.y.jar` file from the GeoServer installation. For example, if running GeoServer 2.25.1, the file to remove would be `gt-complex-31.1.jar`. However, this workaround may disrupt some GeoServer functionality or prevent GeoServer from deploying if the `gt-complex` module is required by the specific GeoServer configuration.
7. How can vulnerable systems be detected?
Vulnerable systems can be detected by identifying GeoServer installations running versions older than the patched releases (2.22.6, 2.23.6, 2.24.4, or 2.25.2). Administrators should check the GeoServer version number. Additionally, the presence of the `gt-complex-x.y.jar` file (where `x.y` corresponds to the GeoTools version) in a GeoServer installation that has not been patched or had the workaround applied indicates potential vulnerability. Network scans or web application vulnerability scanners configured to identify specific GeoServer versions or patterns in OGC request handling might also detect vulnerable instances.
8. What are the indicators of compromise (IOCs)?
Indicators of Compromise (IOCs) for this vulnerability, given its Remote Code Execution nature, could include:
  • Unusual process activity: Detection of unexpected processes running on the GeoServer host, especially those spawned by the GeoServer application's user.
  • Suspicious network connections: Outbound network connections from the GeoServer process to unusual or unauthorized external IP addresses.
  • File system modifications: Creation, modification, or deletion of files in unexpected locations on the server, particularly within the GeoServer installation directory or temporary directories.
  • Web server logs anomalies: Presence of specially crafted, malformed, or unusually long OGC requests targeting WFS GetFeature, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, WFS GetPropertyValue, or WPS Execute endpoints.
  • Increased resource utilization: Sudden spikes in CPU or memory usage associated with the GeoServer process, indicating unauthorized code execution or resource-intensive tasks.
9. Which threat actors are known to exploit this vulnerability?
The CVE data states that "Active exploits have been published to exploit the vulnerability." While no specific threat actor groups are named, the availability of public exploits indicates that a wide range of opportunistic and targeted threat actors, from individual researchers to advanced persistent threat (APT) groups, could potentially leverage this vulnerability.
10. What public intelligence references and advisories exist?
The primary public intelligence reference is CVE-2024-36401 itself. Additionally, users should refer to the official GeoServer project's security advisories and release notes for versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, which detail the patch for this vulnerability.
11. What is the risk assessment and urgency level?
The risk level for CVE-2024-36401 is Critical, evidenced by its CVSS score of 9.8. The urgency level is immediate. This is due to several critical factors:
  • Remote Code Execution (RCE): Allows unauthenticated attackers to execute arbitrary code.
  • Unauthenticated Access: No prior authentication is required for exploitation.
  • Widespread Impact: Affects all GeoServer instances due to a flaw in how simple feature types are handled.
  • Public Exploits: Active exploits have been published, increasing the likelihood of attacks.
Organizations running affected GeoServer versions should prioritize patching or applying the provided workaround without delay to prevent potential compromise.
TypeIndicatorDate
HOSTNAME
ms-tray.top2026-06-05Search on IOC Radar
HOSTNAME
ms-record.top2026-06-05Search on IOC Radar
HOSTNAME
ms-record.com2026-06-05Search on IOC Radar
HOSTNAME
enrollmentdm.com2025-01-11Search on IOC Radar
HOSTNAME
connect-microsoft.com2022-06-24Search on IOC Radar
HASH
9c872a0d5d5a38950e8b9ac9b488be3f2026-06-25Search on IOC Radar
HASH
aa3086be652c8b20b0b29b2730d571192026-06-25Search on IOC Radar
TitleSoftware LinkDate
Delt-A/CVE-2024-36401-pochttps://github.com/Delt-A/CVE-2024-36401-poc2026-05-30
ArcticDU/Exploit-CVE-2024-36401https://github.com/ArcticDU/Exploit-CVE-2024-364012025-07-21
reveravip/Exploit-CVE-2024-36401https://github.com/reveravip/Exploit-CVE-2024-364012025-07-21
holokitty/Exploit-CVE-2024-36401https://github.com/holokitty/Exploit-CVE-2024-364012025-07-21
cochaviz/cve-2024-36401-pochttps://github.com/cochaviz/cve-2024-36401-poc2025-05-04
amoy6228/CVE-2024-36401_Geoserver_RCE_POChttps://github.com/amoy6228/CVE-2024-36401_Geoserver_RCE_POC2025-04-30
whitebear-ch/GeoServerExploithttps://github.com/whitebear-ch/GeoServerExploit2025-01-07
SOCRadar Logo

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence

Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.

CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs
StrikeShark Campaign Exploits Known Vulnerabilities to Deploy Cobalt Strike via SharkLoader - Hong Kong Computer Emergency Response Team Coordination Centre
2026-07-16
StrikeShark Campaign Exploits Known Vulnerabilities to Deploy Cobalt Strike via SharkLoader - Hong Kong Computer Emergency Response Team Coordination Centre | News Content: (Image generated by generative AI and reviewed under professional human supervision.) A recently observed campaign, tracked as StrikeShark, highlights how attackers continue to exploit unpatched internet-facing systems to gain initial access into enterprise networks. The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework. Although the malware components in this campaign demonstrate moderate technical sophistication, the most critical takeaway for organisations is that initial compromise
google.comrssforumnews
June 2026 CVE Landscape
2026-07-10
June 2026 CVE Landscape | In June 2026, Insikt Group® identified 60 high-impact vulnerabilities that should be prioritized for remediation, 30 of which had a Very Critical Recorded Future Risk Score. This represents a 49% increase from last month.In June 2026, Insikt Group® identified 60 high-impact vulnerabilities that should be prioritized for remediation, 30 of which had a Very Critical Recorded Future Risk Score. This represents a 49% increase from last month. 23 of the 60 vulnerabilities were included
cve-2026-34908cve-2023-32315cve-2026-34910cve-2024-21762
Hackers explotan una falla del servidor HTTP Apache para implementar el minero de criptomonedas Linuxsys
Diego Cortes R. ([email protected])2025-07-17
Hackers explotan una falla del servidor HTTP Apache para implementar el minero de criptomonedas Linuxsys | Investigadores de ciberseguridad han identificado una nueva campaña maliciosa que aprovecha una vulnerabilidad conocida en el servidor Apache HTTP para distribuir un criptominero llamado Linuxsys.</p
blogger.comrssforumnews
New SharkLoader malware campaign deploys Cobalt Strike Beacon | brief | SC Media - SC Media
2026-06-29
New SharkLoader malware campaign deploys Cobalt Strike Beacon | brief | SC Media - SC Media | News Content: June 29, 2026 As noted by The Hacker News, a newly discovered cyberattack campaign, dubbed StrikeShark by Kaspersky, is deploying a previously undocumented malware family called SharkLoader. This malware serves as a loader for Cobalt Strike Beacon on compromised hosts. The StrikeShark campaign exhibits a broad geographic reach, targeting a diplomatic organization in Indonesia, government entities in Taiwan, software development companies globally, and other sectors in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. While no direct links to known threat actors exist
google.comrssforumnews
New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks - The Hacker News
2026-06-26
New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks - The Hacker News | News Content: A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts. Kaspersky, which is tracking the activity under the moniker StrikeShark, said the campaign has targeted a diplomatic organization in Indonesia, government organizations in Taiwan, software development companies across multiple countries, and entities associated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. "The observed victimology suggests a campaign with broad
google.comrssforumnews
StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon - gbhackers.com
2026-06-25
StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon - gbhackers.com | News Content: During a recent investigation into activity affecting a diplomatic mission in Indonesia, researchers uncovered a previously undocumented loader family they named SharkLoader. What began as an isolated incident rapidly expanded into a multi-country campaign tracked as StrikeShark where SharkLoader consistently serves as the initial loader that ultimately deploys a Cobalt Strike Beacon on compromised hosts. Observed infection vectors include exploitation of internet-facing services (Microsoft Exchange, SharePoint, Openfire, GeoServer and others) and malware-style droppers masquerading as legitimate installers, indicating the actor combines opportunistic scanning
cve-2021-26855cve-2024-36401cve-2023-32315cve-2022-41082
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader
Fareed Radzi2026-06-24
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader | Kaspersky researchers analyze a new global campaign dubbed StrikeShark that delivers Cobalt Strike Beacon via custom SharkLoader malware.Introduction During our research of activity affecting a diplomatic organization in Indonesia, we uncovered a previously undocumented malware family that we have named SharkLoader. What
securelist.comrssforumnews
avatar
DFIR Radar@DFIR_Radar
7 days ago
CVE-2024-36401 still being actively scanned in the wild: the Rondo botnet is hitting GeoServer installs via OGC filter RCE, dropping a shell script through a multi-stage wget/curl chain. Key findings: - CVE-2024-36401 is an XPath expression injection in GeoServer's OGC filter https://t.co/kqTmsKc6pb
avatar
r0otk3r@r0otk3r
17 days ago
🚨 CVE-2024-36401: Critical 9.8 CVSS GeoServer Unauthenticated RCEHashtags#Cybersecurity https://t.co/Zm89jUiF29 #Infosec #AppSec #RCE #GeoServer #GeoTools #CVE202436401 #PoC #EthicalHacking #BugBounty #PatchNow https://t.co/hK6wre231l
avatar
Cybersecurity News Everyday@TweetThreatNews
2026-01-09
Resecurity deploys a honeypot targeting LAPSUS$ Hunters; XMRig miners exploit GeoServer CVE-2024-36401; CISA adds 245 vulnerabilities to KEV catalog in 2025; rise in China-backed attacks on Taiwan’s infrastructure. #GeoServer #Taiwan #LAPSUSHunters https://t.co/4eAjVIVitC
avatar
r0otk3r@r0otk3r
2026-01-04
🚨 CVE-2024-36401 - Unauthenticated RCE in GeoServer ⚠️ Only for educational purposes &amp; ethical hacking 👍 Like, comment &amp; share if this helped! #CyberSecurity #EthicalHacking #CVE #Exploit #PoC #RedTeam #BugBounty #Infosec #Pentesting #OSCP https://t.co/Hr0dshtvye
avatar
Cybersecurity News Everyday@TweetThreatNews
2025-12-25
Multiple threat actors exploit GeoServer CVE-2024-36401 to deploy XMRig coin miners using PowerShell, bash, certutil, NSSM persistence, and disable Windows Defender across three distinct campaigns. #CoinMining #RemoteCode #GeoServer https://t.co/rTXIuST0Xz
avatar
UNDERCODE NEWS@UndercodeNews
2025-12-25
🚨 GeoServer Zero-Day Exploited at Scale as Threat Actors Weaponize #CVE-2024-36401 for Silent #Crypto #Mining https://t.co/ebmmQWfPIn
avatar
DC3 DCISE@DC3DCISE
2025-12-16
A critical OSGeo GeoServer flaw (CVE-2024-36401) has been added to the Known Exploited Vulnerabilities catalog. This RCE is being actively exploited in the wild to drop crypto miners ⛏️, botnets 🤖, and backdoors. Patch immediately! Visit @Securityaffairs for more info!
avatar
Zeeshan Khan@zeeshankghouri
2025-09-29
🚨 CISA: Hackers exploited GeoServer CVE-2024-36401 RCE to breach a U.S. federal agency on July 11, 2024—moving laterally across servers and deploying China Chopper web shells &amp; LotL tools. Full advisory → https://t.co/XGWb1gcsKd
avatar
Komodo Cyber Security@Komodosec
2025-09-28
#Cybercriminals #VulnerabilityReport CVE-2024-36401 Exploited in Stealthy Bandwidth-Monetization Campaign https://t.co/60H8jToMWL
avatar
avman@avman1995
2025-09-27
RT @TheHackersNews: 🚨 CISA: Hackers exploited GeoServer CVE-2024-36401 RCE to breach a U.S. federal agency on July 11, 2024—moving laterall…
Configuration 1
TypeVendorProduct
AppGeoservergeoserver
AppGeotoolsgeotools
ReferenceLink
GITHUBhttps://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
GITHUBhttps://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
GITHUBhttps://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
GITHUBhttps://osgeo-org.atlassian.net/browse/GEOT-7587
GITHUBhttps://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/geotools/geotools/pull/4797
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
AF854A3A-2127-422B-91AE-364DA2661108https://osgeo-org.atlassian.net/browse/GEOT-7587
AF854A3A-2127-422B-91AE-364DA2661108https://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401
[email protected]https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
[email protected]https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
[email protected]https://github.com/geotools/geotools/pull/4797
[email protected]https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
[email protected]https://osgeo-org.atlassian.net/browse/GEOT-7587
HTTPS://GITHUB.COM/GEOSERVER/GEOSERVER/SECURITY/ADVISORIES/GHSA-6JJ6-GM7P-FCVVhttps://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
HTTPS://GITHUB.COM/GEOTOOLS/GEOTOOLS/PULL/4797https://github.com/geotools/geotools/pull/4797
HTTPS://GITHUB.COM/GEOTOOLS/GEOTOOLS/SECURITY/ADVISORIES/GHSA-W3PJ-WH35-FQ8Whttps://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
HTTPS://GITHUB.COM/WARXIM/CVE-2022-41852?TAB=README-OV-FILE#WORKAROUND-FOR-CVE-2022-41852https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
HTTPS://OSGEO-ORG.ATLASSIAN.NET/BROWSE/GEOT-7587https://osgeo-org.atlassian.net/browse/GEOT-7587
[email protected]https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
[email protected]https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
[email protected]https://github.com/geotools/geotools/pull/4797
[email protected]https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
[email protected]https://osgeo-org.atlassian.net/browse/GEOT-7587
GITHUBhttps://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
GITHUBhttps://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
GITHUBhttps://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
GITHUBhttps://osgeo-org.atlassian.net/browse/GEOT-7587
HTTPS://GITHUB.COM/GEOSERVER/GEOSERVER/SECURITY/ADVISORIES/GHSA-6JJ6-GM7P-FCVVhttps://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
HTTPS://GITHUB.COM/GEOTOOLS/GEOTOOLS/PULL/4797https://github.com/geotools/geotools/pull/4797
HTTPS://GITHUB.COM/GEOTOOLS/GEOTOOLS/SECURITY/ADVISORIES/GHSA-W3PJ-WH35-FQ8Whttps://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
HTTPS://GITHUB.COM/WARXIM/CVE-2022-41852?TAB=README-OV-FILE#WORKAROUND-FOR-CVE-2022-41852https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
HTTPS://OSGEO-ORG.ATLASSIAN.NET/BROWSE/GEOT-7587https://osgeo-org.atlassian.net/browse/GEOT-7587
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/geotools/geotools/pull/4797
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
AF854A3A-2127-422B-91AE-364DA2661108https://osgeo-org.atlassian.net/browse/GEOT-7587
AF854A3A-2127-422B-91AE-364DA2661108https://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401
[email protected]https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
[email protected]https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
[email protected]https://github.com/geotools/geotools/pull/4797
[email protected]https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
[email protected]https://osgeo-org.atlassian.net/browse/GEOT-7587
GITHUBhttps://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401
CWE IDCWE NameDescription
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. eval).
CWE-94Improper Control of Generation of Code ('Code Injection')The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.