Attackers Exploit Unpatched SQL Injection Flaw in GeoServer Security researchers at watchTowr have detected active exploitation attempts targeting an unpatched SQL injection vulnerability in GeoServer, an open-source web server for managing geospatial data. Within hours of public disclosure, attackers began probing vulnerable instances, with hundreds of attempts traced to a small number of source IP addresses. The flaw allows unauthenticated users to inject SQL commands, potentially leading to remote code execution (RCE) if the database runs with administrator permissions on Microsoft SQL Server. While current exploitation attempts appear to be reconnaissance probes rather than delivering malicious payloads researchers warn that this could escalate, given GeoServer’s widespread use in government, defense, science, engineering, and technology sectors. A user on X (formerly Twitter) confirmed the vulnerability’s reproducibility in a non-default configuration, though no patch is yet available. Organizations running GeoServer are advised to restrict public access to exposed instances and monitor logs for signs of compromise. GeoServer has been targeted in past attacks, underscoring its appeal to threat actors seeking high-value targets.