Esri ArcGIS Server CVE-2025-67711

Requires an Esri ArcGIS Server instance version 11.4 or earlier (Windows or Linux) running in one of the specific vulnerable 'some configurations' referenced by the vendor - this is not universal to all deployments, so non-vulnerable/hardened configurations are not affected. Although unauthenticated network access is sufficient to store the payload (PR:N), successful execution requires victim user interaction (UI:R): a user or administrator must load the page rendering the attacker-stored content. The precise triggering feature/endpoint is not enumerated in the provided data; confirm against the ArcGIS Server Security 2025 Update 2 Patch advisory.

This is a genuine but moderate-priority issue, not an over-scored critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1) describes a network-reachable, unauthenticated stored XSS whose real potency is bounded by two factors: it requires victim user interaction (UI:R - a victim must render the stored content) and the description explicitly limits it to 'some configurations,' meaning default/hardened deployments may not be exploitable. No EPSS score is provided; there is no CISA KEV listing and no public POC identified at time of analysis, so there is no evidence of active or automated exploitation. The scope change (S:C) correctly reflects that injected script executes in the victim's browser (a security authority distinct from the vulnerable server), which is why confidentiality and integrity are rated Low rather than None. Net: prioritize patching for internet-facing ArcGIS Server instances (especially those serving admin/console or map-viewer UIs), but this is not an emergency mass-exploitation risk. One data caveat - the exact vulnerable configurations are not enumerated in the provided data; verify applicability against your deployment with the vendor advisory.

A remote unauthenticated attacker submits crafted files/content to an exposed ArcGIS Server endpoint in a vulnerable configuration, where the payload is stored without adequate output encoding. When an administrator or another user later views the affected page, the malicious JavaScript executes in their browser session - enabling session/token theft, UI manipulation, or actions performed as the victim. No public exploit code is identified at time of analysis, and exploitation depends on the victim opening the poisoned content (UI:R).