What is the CVSS score of CVE-2026-9182?

CVE-2026-9182 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ArcGIS Server are affected by CVE-2026-9182?

Esri ArcGIS Server (all versions through 12.0) contains a critical vulnerability permitting remote file uploads without authentication, enabling attackers to execute arbitrary code and seize server…

How to fix or mitigate CVE-2026-9182?

Within 24 hours: Inventory all Esri ArcGIS Server instances across versions through 12.0; immediately restrict network access to administrative/upload endpoints via firewall rules; enable detailed audit logging of all upload activities. Within 7 days: Deploy Web Application Firewall rules to detect and block executable file uploads; implement network segmentation isolating GIS infrastructure; scan for exposed instances accessible from the internet. Within 30 days: Monitor Esri Security Center for patch releases; prepare and test migration or upgrade strategy once patched version becomes available; document all interim controls for compliance review.

ArcGIS Server CVE-2026-9182

EUVD-2026-41896 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-06 Esri

GHSA-xj4c-7w4q-9gwv

File Upload Arcgis Server Esri

9.8

CVSS 3.1 · Vendor: Esri

Severity by source

Vendor (Esri) PRIMARY

9.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote upload to a network endpoint (AV:N/AC:L/PR:N/UI:N); CWE-434 file upload plausibly yields server compromise, so C/I/A:H, though execution is inferred not confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Esri).

CVSS VectorVendor: Esri

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 08, 2026 - 03:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 08, 2026 - 03:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 03:22 vuln.today

cvss_changed

Severity Changed

Jul 08, 2026 - 03:22 NVD

MEDIUM CRITICAL

CVSS changed

Jul 08, 2026 - 03:22 NVD

5.3 (MEDIUM) 9.8 (CRITICAL)

Analysis Generated

Jul 06, 2026 - 19:31 vuln.today

DescriptionCVE.org

ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload.

AnalysisAI

Unrestricted file upload in Esri ArcGIS Server (all versions through 12.0) lets a remote, unauthenticated attacker push arbitrary files to an exposed administrative/upload endpoint, per CVSS PR:N. Esri self-reported the flaw (CWE-434) and rates it critical (CVSS 9.8), and successful upload of an executable payload can lead to full server compromise. There is no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile), indicating it is not yet a mass-exploitation target.

Technical ContextAI

ArcGIS Server is the Esri geospatial application/map-services platform that underpins ArcGIS Enterprise deployments, exposing REST/admin web services over HTTP(S). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): an upload handler fails to validate file type, extension, or content, so an attacker can place attacker-controlled files-potentially server-side executable content such as a web shell-into a location the server processes. The affected component is identified by CPE cpe:2.3:a:esri:arcgis_server, and the network-facing service surface (AV:N) is what makes remote reach possible without prior access.

RemediationAI

Apply the fix per vendor advisory: consult Esri's May 2026 ArcGIS security bulletin (https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/may-2026-arcgis-security-bulletin) and upgrade to the patched ArcGIS Server release Esri specifies-an exact fixed version number is not provided in the available data, so verify it directly against that bulletin (patch available per vendor advisory). Until patched, reduce exposure by restricting network access to the ArcGIS Server admin and upload endpoints so they are not reachable from the internet (place behind a VPN or IP allowlist), and put a WAF/reverse proxy in front to block or restrict multipart file uploads and dangerous extensions to the affected endpoint-side effect: legitimate administrative uploads or publishing workflows through that path may break and require operator whitelisting. Also disable or firewall any unused ArcGIS Server web adaptor/admin interface exposed externally, accepting that remote administration convenience is lost.