Esri ArcGIS Server CVE-2025-67705

Exploitation requires an affected ArcGIS Server (version 11.4 or earlier) running one of the unspecified vulnerable 'some configurations' the vendor references - it is NOT triggerable against every default install. No authentication is required (PR:N), and the server endpoint that accepts the stored malicious file must be network-reachable. Critically, exploitation is gated on victim user interaction (UI:R): a user or administrator must subsequently load the attacker-poisoned content in a browser for the injected script to execute. Impact is confined to the victim's browser session (client-side script execution), not direct server compromise.

This is a genuine-but-moderate risk, not a top-tier priority. The CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is consistent with the description: a network-reachable, unauthenticated stored XSS that requires victim user interaction (UI:R) to trigger and yields only limited confidentiality/integrity impact (C:L/I:L) with a scope change (S:C) as the injected script executes in the victim's browser context rather than the server's. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or imminent mass exploitation; stored XSS in an administrative/GIS product is more typically leveraged in targeted rather than widespread campaigns. A key qualifier is 'in some configurations' - the flaw is not universally exploitable on default installs, which further tempers real-world risk. The signals are internally consistent (no CVSS-vs-description conflict), and a vendor patch already exists, making this a straightforward patch-and-move-on item rather than an emergency.

A remote unauthenticated attacker submits crafted content to an affected, appropriately-configured ArcGIS Server endpoint, storing a file containing malicious JavaScript. When an administrator or other user later views that content in their browser, the script executes in their session context, enabling session/token theft or actions on their behalf. No public exploit code is identified at time of analysis, and successful exploitation depends on a victim actually loading the poisoned content (UI:R).