CISA has shared details on the exploitation of a year-old GeoServer vulnerability to compromise a federal agency.