GeoServer is being used as an execution foothold, not just a vulnerable web app. The exploit turns a map query into an OS command, so a public GeoServer can be made to fetch and run malware straight away instead of just crashing or leaking data.
SANS ISC saw active exploitation in logs tied to CVE-2024-36401. The payload used an `exec()` XPath expression and fetched a Rondo botnet script with `wget`, `busybox wget`, or `curl`, which means exposed GeoServer instances can be pulled into follow-on malware activity as soon as they are hit.