ArcGIS Server CVE-2025-67710

Exploitation requires a vulnerable ArcGIS Server instance running version 11.4 or earlier on Windows or Linux that is in one of the 'some configurations' the vendor describes as susceptible - meaning default or hardened deployments may not be exploitable, so this is a non-default/configuration-dependent condition. Two factors limit real-world exploitation: (1) a victim must actively view the stored malicious content (UI:R), and (2) the specific vulnerable configuration must be present. No authentication is required to store the payload (PR:N). Patching to ArcGIS Server Security 2025 Update 2 or later removes the flaw.

This is a moderate-severity stored XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in Esri ArcGIS Server 11.4 and earlier. The CVSS vector signals a network-reachable, low-complexity flaw exploitable without authentication (PR:N) but requiring victim interaction (UI:R) and yielding only limited confidentiality/integrity impact with a scope change (S:C) into the victim's browser. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or automated exploitation - this reads as a real but non-urgent hardening priority rather than a widely-weaponized threat. A notable qualifier is the description's phrase 'in some configurations,' which means default deployments may not be affected; this tempers the PR:N/AV:N signal because reachability depends on how the server is configured. No conflicting access-vector signals were found (description and CVSS both point to remote unauthenticated storage of the payload); the main uncertainty is which specific configurations are vulnerable, which the vendor advisory should clarify.

A remote unauthenticated attacker submits a file containing malicious script to a vulnerable, appropriately-configured ArcGIS Server endpoint, where it is stored. When an administrator or another user later views the affected page or content, the script executes in their browser session, enabling session/content actions in that authenticated context. No public exploit code was identified in the provided data, and successful exploitation depends on both a susceptible configuration and a victim viewing the stored content.