Esri ArcGIS Server CVE-2025-67709

Exploitation requires ArcGIS Server 11.4 or earlier (Windows or Linux) deployed in one of the affected 'some configurations' explicitly noted by the vendor - meaning non-default or specific setups are the trigger, not every install. The attacker can store the payload without authentication (PR:N), but successful execution depends on a victim subsequently loading the stored malicious content in a browser (UI:R). The limited scope of affected configurations and the required victim interaction are the primary factors constraining real-world exploitation.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) is internally consistent for a stored XSS: network-reachable, no privileges (PR:N, so unauthenticated per the description), but requiring victim interaction (UI:R) and yielding only limited confidentiality/integrity impact in the victim's browser (C:L/I:L) with a scope change (S:C) as the injected script escapes the server's security authority into the client. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is referenced - so there is no signal of active exploitation or automatable mass-exploitation. This is a real but moderate-priority issue: the unauthenticated storage capability is notable for a stored XSS, but the description explicitly qualifies it with 'in some configurations,' meaning default deployments may not be exposed, and the need for a victim to load the malicious content caps practical impact. Absent EPSS/KEV/POC signals, treat this as a patch-in-normal-cycle item rather than an emergency, prioritizing internet-facing ArcGIS Server instances in the affected configuration.

A remote unauthenticated attacker abuses an exposed ArcGIS Server upload or storage function (in an affected configuration) to store a file containing malicious script. When an administrator or authenticated user later views that content in the server's web interface, the script executes in their browser session, enabling session/token theft or actions in the victim's context. No public proof-of-concept is referenced in the provided data.