CISA has revealed that attackers breached the network of an unnamed U.S. federal civilian executive branch (FCEB) agency last year after compromising an unpatched GeoServer instance. The security bug (tracked as CVE-2024-36401) is a critical remote code execution (RCE) vulnerability patched on June 18, 2024. CISA added the flaw to its catalog of actively exploited vulnerabilities roughly one month later, after multiple security researchers shared proof-of-concept exploits online [1, 2, 3], demonstrating how to gain code execution on exposed servers. While the cybersecurity agency did not provide any details on how the flaws were being exploited in the wild, threat monitoring service Shadowserver observed CVE-2024-36401 attacks starting on July 9, 2024, while OSINT search engine ZoomEye…