Esri ArcGIS Server EUVD-2026-110061

Exploitation requires that the ArcGIS Server instance be in one of the unspecified susceptible configurations ('in some configurations') and that a victim subsequently load the attacker-stored content in a browser (UI:R) - there is no automatic, interaction-free trigger. The exact feature, upload path, or configuration setting that enables the stored injection is not described in the available sources. Limiting factors: required victim interaction, dependence on a non-default/specific configuration rather than all deployments, and impact confined to the victim's browser session (no server-side confidentiality/integrity/availability loss). Affected: ArcGIS Server 11.1 and earlier on Windows and Linux; patched branches are 12.1, 12.0, 11.5, 11.3, and 11.1, with mature/retired versions not patch-eligible (vendor advises upgrading).

This is a moderate-severity stored XSS (CVSS 3.1 base 6.1) whose signals are internally consistent but point to limited real-world urgency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated injection whose payload only executes once a victim loads the affected content (UI:R), with a scope change (S:C) reflecting that code runs in the victim's browser rather than on ArcGIS Server itself. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present - the only reference is the vendor's October 2026 ArcGIS security bulletin. The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with a patch-on-normal-cadence posture rather than drop-everything. Two caveats temper the raw vector: the description says exploitation is possible only 'in some configurations,' so the PR:N/AC:L rating may overstate exploitability in default deployments, and the impact is confidentiality/integrity-limited with no availability impact. Net: a genuine but not emergency priority - patch within the normal cycle; it is not a high-CVSS-but-illusory issue, but neither is there evidence of active or imminent mass exploitation.

A remote unauthenticated attacker uploads or stores a file containing a malicious script into a vulnerable ArcGIS Server instance that is in a susceptible configuration. When an administrator or other user later views the attacker-controlled content in their browser, the stored script executes in their session context, enabling actions such as session/token theft or UI manipulation. No public exploit code or PoC reference was provided in the input.