#geoserver

Analysis · Jun 20, 2026 · Colten Anderson

GeoServer CVE-2024-36401: The Map Nobody Owned

A CVSS 9.8 unauthenticated RCE in GeoServer sat unpatched at thousands of agencies for weeks. The bug was the easy part. The reason nobody patched it is the real story.