- Joined
- Jan 22, 2026
- Messages
- 101
- Reaction score
- 922
Unknown persons methodically check the strength of every open entrance.
In January 2026, against the background of the usual wave of automated scanning on the Internet, one area stood out noticeably: attackers began to "probe" GeoServer and related services more often. According to F5 Labs telemetry, the activity of requests to GeoServer-specific paths increased by 50% in a month compared to December.
The growing interest is due to the fact that GeoServer is often intentionally kept accessible from an external network to work with geodata and OGC standards, including WMS, WFS and OWS. This openness simplifies integration, but at the same time makes the system a convenient target: the service is easily recognized remotely by a characteristic set of operations, and processing complex parameters expands the attack surface.
The January traffic was dominated by GET requests (93%), but the share of posts (7%) is also important, since it is through the request body that more "heavy" checks and impact attempts are often sent. The requests were grouped around three tasks: checking OGC services (especially WFS), searching for the GeoServer web interface, and validating WMS endpoints.
In logs, this usually looks like a series of accesses to /geoserver/, then to /geoserver/web/ and Wicket bookmarked pages, after which massive feature checks begin via GetCapabilities and enumeration of Stored Queries in WFS 2.0. Accesses to the authentication handler /geoserver/j_spring_security_check, test checks of POST behavior, and attempts to get to the REST documentation.
The authors of the report note that single requests may look ordinary in themselves, but repeatability and address clusters more often indicate preparation for further action.: enumeration of layers and capabilities, testing vulnerable parameter processing paths, and in some cases delivering malicious load. An additional signal of instrumental activity was the substitution of the User-Agent string for regular browsers, the use of outdated User-Agent values, and a significant proportion of requests with an empty User-Agent.
The attention to GeoServer is fueled by fresh vulnerability descriptions. The article mentions CVE-2025-58360, which is associated with XXE in WMS GetMap processing, which can potentially lead to file reading, SSRF, or denial of service, as well as CVE-2024-36401, which deals with remote code execution without authentication through specially configured parameters in several OGC operations. It is emphasized separately that the tools usually check not one problem, but a set at once, so old defects continue to "live" in scanner databases for years.
In addition to GeoServer, F5 Labs highlighted the overall top most exploited vulnerabilities for January 2026. The leader remains CVE-2017-9841 in PHPUnit with 70,867 exploitation attempts. In second place is CVE-2025-55182, affecting React Server Components and unsafe deserialization, with 19,624 attempts. Next are CVE-2019-9082 in ThinkPHP (4152), CVE-2024-4577 in Apache PHP-CGI (4089), and CVE-2022-24847 in GeoServer related to JNDI Lookup (2455). In the long-term dynamics, there was a sharp decrease in activity on CVE-2023-1389 and a simultaneous increase in interest in CVE-2023-25157.
In January 2026, against the background of the usual wave of automated scanning on the Internet, one area stood out noticeably: attackers began to "probe" GeoServer and related services more often. According to F5 Labs telemetry, the activity of requests to GeoServer-specific paths increased by 50% in a month compared to December.
The growing interest is due to the fact that GeoServer is often intentionally kept accessible from an external network to work with geodata and OGC standards, including WMS, WFS and OWS. This openness simplifies integration, but at the same time makes the system a convenient target: the service is easily recognized remotely by a characteristic set of operations, and processing complex parameters expands the attack surface.
The January traffic was dominated by GET requests (93%), but the share of posts (7%) is also important, since it is through the request body that more "heavy" checks and impact attempts are often sent. The requests were grouped around three tasks: checking OGC services (especially WFS), searching for the GeoServer web interface, and validating WMS endpoints.
In logs, this usually looks like a series of accesses to /geoserver/, then to /geoserver/web/ and Wicket bookmarked pages, after which massive feature checks begin via GetCapabilities and enumeration of Stored Queries in WFS 2.0. Accesses to the authentication handler /geoserver/j_spring_security_check, test checks of POST behavior, and attempts to get to the REST documentation.
The authors of the report note that single requests may look ordinary in themselves, but repeatability and address clusters more often indicate preparation for further action.: enumeration of layers and capabilities, testing vulnerable parameter processing paths, and in some cases delivering malicious load. An additional signal of instrumental activity was the substitution of the User-Agent string for regular browsers, the use of outdated User-Agent values, and a significant proportion of requests with an empty User-Agent.
The attention to GeoServer is fueled by fresh vulnerability descriptions. The article mentions CVE-2025-58360, which is associated with XXE in WMS GetMap processing, which can potentially lead to file reading, SSRF, or denial of service, as well as CVE-2024-36401, which deals with remote code execution without authentication through specially configured parameters in several OGC operations. It is emphasized separately that the tools usually check not one problem, but a set at once, so old defects continue to "live" in scanner databases for years.
In addition to GeoServer, F5 Labs highlighted the overall top most exploited vulnerabilities for January 2026. The leader remains CVE-2017-9841 in PHPUnit with 70,867 exploitation attempts. In second place is CVE-2025-55182, affecting React Server Components and unsafe deserialization, with 19,624 attempts. Next are CVE-2019-9082 in ThinkPHP (4152), CVE-2024-4577 in Apache PHP-CGI (4089), and CVE-2022-24847 in GeoServer related to JNDI Lookup (2455). In the long-term dynamics, there was a sharp decrease in activity on CVE-2023-1389 and a simultaneous increase in interest in CVE-2023-25157.
