Esri ArcGIS Server CVE-2025-67704

Requires a vulnerable ArcGIS Server 11.4 or earlier instance (Windows or Linux) running in one of the affected non-default configurations - the description explicitly limits exploitation to 'some configurations', so a default/hardened install may not be affected. No authentication is needed (PR:N), but exploitation depends on victim interaction (UI:R): a user must view the page containing the stored payload for the script to fire. The impact is confined to the victim's browser context (scope change), not direct server compromise, which limits severity.

This is a genuine but moderate-priority issue: a stored (persistent) XSS in Esri ArcGIS Server 11.4 and earlier. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) indicates a network-reachable, unauthenticated attacker (PR:N) who needs a victim to view the stored payload (UI:R), with a scope change (S:C) reflecting execution in the victim's browser rather than the server itself, and limited confidentiality/integrity impact (C:L/I:L, no availability impact). No EPSS score, KEV listing, or public POC is present in the provided intelligence - so there is no evidence of active exploitation and no SSVC automatable/exploitation signal to elevate it. The description qualifier 'in some configurations' means exploitation is gated on non-default settings, which realistically lowers exposure below what the AC:L / PR:N vector alone would suggest; this tension between the low-complexity vector and the 'some configurations' precondition should be verified against the vendor advisory. Net: a real, patchable web vulnerability worth remediating on a normal cycle, not an emergency, absent any exploitation telemetry.

A remote unauthenticated attacker submits a crafted file/input to a vulnerable, appropriately-configured ArcGIS Server endpoint so that malicious script is stored server-side. When an administrator or other user later views the affected page, the script executes in their browser under the ArcGIS Server origin, enabling session/token theft or actions in the victim's context. No public exploit code is identified at time of analysis, and success requires victim interaction (viewing the poisoned content).