GeoServer CVE-2024-36401 OGC Filter RCE Exploitation Attempt

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•6

This rule detects attempts to exploit CVE-2024-36401, a critical remote code execution vulnerability in GeoServer. The rule monitors inbound HTTP requests to GeoServer OWS or WFS endpoints for malicious patterns consistent with OGC filter expression injection, such as attempts to invoke Java Runtime process execution via crafted property names or OGC expressions.