GeoServer CVE-2024-36401 OGC Filter RCE Exploitation for Initial Access

Ibrahim Saud@tektrix

•updated Jun 28, 2026•3•0•4

Detects exploitation attempts against GeoServer targeting CVE-2024-36401, a vulnerability involving unsafe OGC filter property name evaluation. The rule monitors for malicious HTTP patterns in incoming requests to OGC endpoints (ows, wfs, wms, wcs) and identifies subsequent suspicious process spawning by the GeoServer JVM instance that indicate successful remote code execution.