Esri ArcGIS Server CVE-2026-33522

Exploitable only against ArcGIS Server versions 11.3 through 12.0 - the description states this range ONLY, so instances outside it are not affected. No special configuration, feature toggle, authentication, or user interaction is required (AV:N/AC:L/PR:N/UI:N): a remote unauthenticated attacker who can reach the server can update service metadata. The primary limiting factors are the narrow affected-version window and the requirement that the attacker have network reachability to the ArcGIS Server endpoint; impact is confined to metadata integrity, with no confidentiality or availability effect. Versions in mature or retired status are not patch-eligible, so operators on those builds must upgrade to a supported, patched branch (12.0, 11.5, or 11.3) as the vendor states upgrading-and-patching is the remedy.

This is a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 MEDIUM) describes a remote, low-complexity, unauthenticated flaw whose only impact is a limited integrity breach - an attacker can update service metadata but cannot read data (C:N) or disrupt availability (A:N). The vuln.today decision label is 'this_month', consistent with a medium-severity integrity-only issue rather than act_now/emergency. There is no CISA KEV listing, so there is no 'confirmed actively exploited' signal, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified here. No public exploit or PoC reference is present in the input either. The signals are therefore internally consistent: network-reachable and unauthenticated (which raises exposure) but low technical impact (which caps real-world damage). The practical risk is unauthorized tampering with service metadata - potentially misleading map/service consumers or enabling follow-on social-engineering - not data theft or outage. Treat as a planned-patching item, scheduled within the maintenance window, not a drop-everything event.

A remote attacker with no credentials sends a request to an internet-reachable ArcGIS Server instance running an affected version (11.3 through 12.0) and modifies the metadata of a published service. The specific request mechanism is not described in the available sources. No public exploit code was identified in the input, so exploitation would require the attacker to independently develop the request.