ArcGIS Server CVE-2025-67707

Requires an internet- or network-reachable ArcGIS Server (version 11.5 or earlier, on Windows or Linux) exposing the file-upload functionality to unauthenticated requests. Although no authentication or user interaction is needed (PR:N/UI:N), the description explicitly states that meaningful exploitation additionally requires one of: winning a race condition, possession of a secret value, or a man-in-the-middle position - these constitute the AC:H attack complexity and are the primary limiting factors. Impact is further constrained by architecture: uploads are confined to non-executable storage directories, so files cannot be executed, cannot replace existing application components or system configuration, cannot escalate privileges, and cannot be used to read sensitive data.

This is a LOW real-world priority despite the CWE-434 (file upload) classification and network attack vector. The CVSS 5.6 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) tells the real story: while exploitation is remote and unauthenticated (PR:N), the AC:H reflects that the description explicitly requires race conditions, secret values, or man-in-the-middle conditions to exploit - these are significant real-world hurdles, not incidental. Crucially, the vendor's own description narrows impact severely: uploaded files land in non-executable storage, cannot be executed, cannot escalate privileges, cannot access sensitive data, and cannot modify existing application components or system configuration. This makes it fundamentally different from a typical CWE-434 flaw that leads to webshell RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the input, and SSVC data is not provided. The low-and-limited impact plus the AC:H exploitation gating strongly indicate a high-CVSS-mechanism-but-low-real-risk issue rather than an urgent priority. Note a signal conflict worth flagging: the input tags 'Authentication Bypass' and 'Information Disclosure' contradict the description, which states there is no unauthorized access and no integrity compromise - these tags appear mislabeled and should not drive prioritization.

A remote unauthenticated attacker sends crafted file-upload requests to an internet-reachable ArcGIS Server (11.5 or earlier) and places arbitrary files into the server's designated upload directories. Because the architecture confines uploads to non-executable storage and blocks execution, privilege escalation, and data access, the practical outcome is limited storage abuse; meaningful impact additionally hinges on winning a race condition, knowing a secret value, or holding a MITM position (AC:H). No public exploit code is identified at time of analysis.