GeoServer Zero-Day SQL Injection Draws Mass Probes Within Hours of Disclosure

A critical SQL injection vulnerability in GeoServer's jsonArrayContains filter was publicly disclosed on August 14, 2026, allowing attackers to inject malicious arguments into backend database queries on PostGIS, Oracle JDBC, and H2 data stores. Security firm WatchTowr observed hundreds of exploit attempts from a small number of source IPs within hours of the public disclosure. The flaw can potentially escalate to remote code execution depending on the server's database configuration, though RCE has not been confirmed across all affected deployments. No patches were available at the time of publication, and no successful compromises have been publicly confirmed despite the volume of probing activity. Administrators are advised to isolate GeoServer from public internet access, apply WAF rules to block malformed filter inputs, and enforce database least-privilege principles until an official fix is released.