ArcGIS Server CVE-2025-67703

Exploitation requires a non-default/specific ArcGIS Server configuration - the vendor explicitly limits impact to 'some configurations,' so default installs may not be vulnerable. It further requires victim interaction (UI:R): a user must load the page rendering the stored malicious content for the script to execute. Affected scope is ArcGIS Server 11.4 and earlier on both Windows and Linux. No authentication is needed to plant the payload (PR:N), but the payload only fires against users who subsequently view it, and impact is confined to the victim's browser context (C:L/I:L, no availability impact).

This is a stored cross-site scripting flaw (CWE-79) in Esri ArcGIS Server 11.4 and earlier. The vendor-supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium) indicates a network-reachable, low-complexity, unauthenticated injection that nonetheless requires victim interaction (UI:R - the victim must load the poisoned content) and yields only limited confidentiality and integrity impact within the browser context, with a scope change (S:C) reflecting execution crossing from the server into the victim's browser session. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Crucially, the description states the flaw is exploitable only 'in some configurations,' meaning default installations may not be affected - this materially lowers real-world risk below what the unauthenticated network vector alone would suggest. Net: a legitimate Medium-severity issue worth patching in ArcGIS environments, but not an urgent, mass-exploitable priority absent any active-exploitation or POC signal.

A remote unauthenticated attacker abuses a vulnerable, specifically-configured ArcGIS Server endpoint to upload/store a file containing malicious script. When an administrator or other user later views the affected page, the script executes in their browser, enabling session/token theft or actions in the victim's authenticated context. No public exploit code is identified, and successful exploitation depends on both a susceptible configuration and victim interaction.