Esri vulnerabilities

195 vulnerabilities

Known vulnerabilities in Esri products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 33 products.

Products

33
6.1MediumCVE-2026-50096esri · arcgis serverBUG-000187164 - ArcGIS Server has a security vulnerability.There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.6.1MediumCVE-2026-50095esri · arcgis serverBUG-000187165 - ArcGIS Server has a security vulnerability.There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.5.3MediumCVE-2026-33522esri · arcgis serverBUG-000182936 - ArcGIS Server has a security vulnerability.Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.7.5HighCVE-2026-33521esri · arcgis serverBUG-000186514 - ArcGIS Server has a security vulnerability.There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.6.1MediumCVE-2026-33520esri · arcgis serverBUG-000185167 - ArcGIS Server has a security vulnerability.There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for impacted ArcGIS Server software in General Availability and Extended support status, which includes versions 11.5. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.9.8CriticalCVE-2026-10757esri · arcgis serverBUG-000187511 - ArcGIS Server has a security vulnerability.There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.9.8CriticalCVE-2026-69227esri · portal_for_arcgisBUG-000187331 Portal for ArcGIS has a security vulnerabilityA flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.EPSS0.33%6.5MediumCVE-2026-69226esri · portal_for_arcgisPortal for ArcGIS has a security vulnerabilityA flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.EPSS0.18%5.5MediumCVE-2026-10759esri · portal_for_arcgisBUG-000171040 Portal for ArcGIS has a security vulnerabilityA flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.EPSS0.25%3.5LowCVE-2013-7231esri · arcgis serveresri arcgis serverCross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.EPSS1.08%7.5HighCVE-2013-7232esri · arcgis serveresri arcgis serverSQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.EPSS2.29%3.5LowCVE-2013-5221esri · arcgis serveresri arcgis serverThe mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.EPSS1.08%3.5LowCVE-2013-5222esri · arcgis serveresri arcgis serverMultiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.EPSS1.08%6.1MediumCVE-2021-29103esri · arcgis serverThere is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.EPSS0.74%6.8MediumCVE-2021-29094esri · arcgis serverArcGIS Server image service and raster analytics security update: buffer overflowMultiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.EPSS1.04%7.8HighCVE-2021-29096esri · arcgis desktop +6 moreArcGIS general raster security update: use-after-freeA use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.EPSS1.58%5.3MediumCVE-2021-29099esri · arcgis serverThere is a SQL injection vulnerability in ArcGIS ServerA SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.EPSS0.63%6.1MediumCVE-2021-29109esri · portal_for_arcgisA reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.EPSS0.74%4.7MediumCVE-2021-29113esri · arcgis serverRemote file inclusion vulnerability in ArcGIS Server help documentationA remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.EPSS0.84%8.6HighCVE-2021-29101esri · arcgis_geoevent_serverArcGIS GeoEvent Server has a Directory Traversal security vulnerability.ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.EPSS2.29%