What is the CVSS score of CVE-2026-2812?

CVE-2026-2812 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

ArcGIS Server CVE-2026-2812

EUVD-2026-31147 MEDIUM

Improper Authentication (CWE-287)

2026-05-20 Esri

GHSA-3wjj-6pp2-788h

Authentication Bypass Arcgis Server

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 20:03 vuln.today

DescriptionCVE.org

ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier.

AnalysisAI

Improper authentication on an undocumented administrative endpoint in ArcGIS Server 11.1 through 12.0 allows unauthenticated remote attackers to disrupt the web-based browsing interface by sending a crafted HTTP request. The vulnerability is classified as CWE-287 and carries a CVSS 5.3 medium score, reflecting network-reachable, zero-privilege exploitation offset by limited impact (integrity only, no confidentiality or availability loss). No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

ArcGIS Server (CPE: cpe:2.3:a:esri:arcgis_server) is Esri's enterprise GIS platform used for hosting and managing geographic information services. The root cause is CWE-287 (Improper Authentication): an undocumented administrative endpoint fails to enforce authentication before processing requests, allowing crafted inputs to reach privileged logic without credential validation. The endpoint's undocumented nature suggests it may be a legacy or internal maintenance interface that was not subjected to the same access control review as documented APIs. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no special network position or privileges are required to reach and interact with this endpoint.

RemediationAI

Consult the Esri April 2026 security bulletin at https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin for the official patch. No specific fixed version number was provided in the available input data, so the patch status is 'patch available per vendor advisory' - verify the exact upgrade target directly with Esri. As a compensating control, restrict network access to ArcGIS Server administrative endpoints via perimeter firewall or web application firewall rules, limiting exposure to trusted administrative IP ranges only; note that this does not fix the underlying authentication flaw but reduces the attack surface. If the undocumented endpoint can be identified through traffic analysis, blocking it at the reverse proxy layer is a targeted mitigation with minimal operational impact on standard GIS services.