Esri ArcGIS Server EUVD-2026-110059

The target must be a network-reachable ArcGIS Server instance running version 12.0 or prior, exposed to the attacker (no authentication required per PR:N, no user interaction per UI:N). The limiting factor is vendor-stated directly: the thread-exhaustion denial of service occurs only 'under exceptional circumstances,' meaning it is not described as reliably reproducible against a default deployment, and the sources do not specify the exact request pattern or configuration that triggers it. Patch eligibility is restricted to GA/Extended-support versions (12.0, 11.5, 11.3, 11.1); instances on mature or retired versions are not patch eligible and must be upgraded to a listed version before the patch can be applied.

The CVSS 3.1 base score is 7.5 (HIGH) driven entirely by availability impact (A:H) with a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) and no confidentiality or integrity impact (C:N/I:N) - consistent with a CWE-400 uncontrolled resource consumption (worker-thread exhaustion) denial of service. However, the signals should be weighed carefully. There is no CISA KEV listing and no public exploit or PoC reference in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from this data. The vuln.today decision label is 'this_week,' indicating elevated but not emergency urgency. A notable tension: the CVSS vector encodes AC:L (low complexity), yet the vendor description explicitly says service denial occurs only 'under exceptional circumstances,' which suggests the condition is not reliably reproducible on demand - the vector's AC:L and the prose's 'exceptional circumstances' qualifier are in tension, and the real trigger conditions are not described in the available sources. Net: a legitimate HIGH-severity availability issue worth patching on a near-term schedule, but with no evidence of active exploitation or weaponization, this is a prioritized-but-not-emergency item rather than a drop-everything event; the impact is downtime only, not data compromise.

A remote, unauthenticated attacker on the network sends specially crafted requests to an exposed ArcGIS Server endpoint that, under the right (vendor-described 'exceptional') circumstances, cause all available worker threads to be consumed, blocking legitimate users from the mapping/GIS service. No public exploit code or PoC reference is identified in the available data, and the precise request pattern that triggers the condition is not described in the sources. Impact is limited to loss of availability - no code execution, data disclosure, or integrity loss.