GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A zero-day vulnerability in GeoServer is being actively exploited, according to watchTowr. The flaw is an SQL injection vulnerability that can lead to remote code execution. It was disclosed by a researcher on August 12, 2026, and has not been assigned a CVE identifier yet. The vulnerability remains unpatched, leaving the open-source platform vulnerable to attack.