A federal agency suffered a cyber intrusion in July 2024 due to unpatched vulnerabilities (CVE-2024-36401) in its public-facing GeoServer, exploited by threat actors to gain initial access. The attackers leveraged the critical RCE flaw to deploy open-source tools (e.g., China Chopper web shells), scripts for persistence, and lateral movement techniques—including brute-force attacks and Living-off-the-Land (LOTL) methods. Over three weeks, they compromised a second GeoServer, a web server, and an SQL server, escalating privileges and maintaining undetected access.The breach stemmed from failures in vulnerability remediation (patching delayed despite vendor fixes and CISA KEV inclusion), incident response (untested plans, slow third-party engagement), and EDR gaps (unmonitored alerts, unprotected endpoints like the web server). The agency’s delayed detection allowed prolonged adversary activity, risking data exfiltration, system takeover, and operational disruption. While CISA confirmed no cross-agency impact, the incident underscored critical deficiencies in federal cybersecurity posture, particularly in automated patch enforcement and continuous monitoring.