Esri ArcGIS Server CVE-2025-67708

Requires a vulnerable ArcGIS Server instance (version 11.4 or earlier, on Windows or Linux) that is reachable by the attacker and running in one of the affected non-default configurations - the vendor scopes the unauthenticated storage path to 'some configurations,' so a default/hardened deployment may not expose it. Exploitation is unauthenticated (PR:N) for the storage step but is NOT self-contained: it requires victim user interaction (UI:R) - a legitimate user (e.g., an admin or another viewer) must subsequently open the attacker-stored content in a browser for the payload to fire. Limiting factors: the dependence on a specific configuration, the need for victim interaction, and impact confined to the victim's browser context (Low C, Low I, no A) rather than server compromise.

This is a legitimate but moderate-severity issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1) describes a network-reachable, unauthenticated stored XSS whose execution requires a victim to load the poisoned content (UI:R), with a scope change (S:C) reflecting script running in the victim's browser trust context rather than the server. Impacts are limited to Low confidentiality and Low integrity, with no availability impact - consistent with typical stored XSS. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so there is NO evidence of active exploitation or automatable mass-exploitation; exploitation status is 'no public exploit identified at time of analysis.' A key qualifier from the vendor description tempers the raw score: the unauthenticated storage path only exists 'in some configurations,' meaning default/hardened deployments may not be vulnerable - so the PR:N in the vector likely reflects a non-default configuration rather than every install. Net: prioritize patching for internet-exposed ArcGIS Server instances, but this is a routine 'important' web-app flaw, not a critical drop-everything item, absent any exploitation signal.

An unauthenticated attacker submits a crafted file or field containing malicious script to a vulnerable ArcGIS Server endpoint that stores unsanitized content. When an administrator or another user later views that stored content in their browser, the script executes in their session context, enabling session/token theft or actions on their behalf. No public POC or evidence of active exploitation is available, and the attack requires victim interaction (UI:R) plus a susceptible non-default configuration.