Esri
Monthly
Denial of service in Esri ArcGIS Server 12.0 and earlier can occur when crafted requests exhaust all available worker threads, denying service to legitimate users. The issue is remotely reachable without authentication or user interaction, but Esri describes the thread exhaustion as occurring only under exceptional circumstances and does not specify the exact trigger. Patches are available for the General Availability and Extended support branches 12.0, 11.5, 11.3, and 11.1; no public exploit was identified at time of analysis.
SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux allows remote attackers to invoke database-specific functions that should not be permitted, with high confidentiality, integrity, and availability impact. In default deployments the attacker must hold privileges to access the targeted service; fully anonymous exploitation is possible only when a service is explicitly configured in the non-default 'public' access mode, so realistic exposure is lower than the input 9.8 base score suggests. The vendor has released patches for 12.1, 12.0, 11.5, 11.3, and 11.1, and no public exploit is identified in the supplied data.
Unauthenticated access to administrative API endpoints in Esri Portal for ArcGIS can let remote attackers reach /portaladmin/local functionality that should require authentication, potentially exposing portal administration with high confidentiality, integrity, and availability impact. Exploitation is conditional - the independent assessment rates CVSS 3.1 as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning high impact but dependent on unspecified portal configuration conditions, while the vendor input vector is 9.8 with AC:L - and no public exploit has been identified at time of analysis. Affected product is Portal for ArcGIS, tracked by CPE cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*; consult Esri's September 2026 bulletin for exact affected versions and fixes.
Heap-based out-of-bounds write in the Esri LERC raster library 4.1.0 and earlier lets a remote, unauthenticated attacker crash an application that decodes attacker-supplied LERC imagery, resulting in a denial of service. Exploitation is possible only where a consuming application exposes a decode path for untrusted LERC input (for example imagery uploads, tile requests, or raster ingestion pipelines); the library is not a network service itself, so reachability is entirely dependent on the host application, and impact is confined to a process crash with no confirmed route to code execution or data disclosure. No public exploit code was identified at time of analysis and the issue has not been confirmed as actively exploited (CISA KEV); CVSS 3.1 scores it 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact requiring no privileges or user interaction on a reachable decode path.
Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 allows remote unauthenticated attackers to extract sensitive data reflected in HTTP response bodies via crafted requests. The vulnerability (CWE-200) requires no authentication or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, meaning any internet-exposed Portal instance in the affected version range is potentially reachable without credentials. No public exploit or KEV listing exists at time of analysis, and SSVC classifies exploitation as none with partial technical impact, indicating limited observed threat activity despite the high confidentiality impact scored by NVD.
Sensitive information reflection in Esri Portal for ArcGIS versions 11.1 through 12.0 exposes confidential content in HTTP response bodies to remote, unauthenticated attackers under specific, difficult-to-reproduce conditions. The vulnerability stems from improper information exposure (CWE-200), where a crafted request can cause the server to echo sensitive data back in its response. No active exploitation has been confirmed, and EPSS probability is low at 0.33%, though CVSS rates confidentiality impact as high given the potential sensitivity of reflected data.
Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a critical API endpoint that a remote, unauthenticated attacker can reach directly, bypassing access controls to interact with functionality that should require an authenticated session. Esri rates this critical (CVSS 9.8) and disclosed it in its June 2026 ArcGIS security bulletin; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the exposed function is an administrative/portal API reachable over the network with no credentials, successful access could lead to disclosure or manipulation of portal content and configuration.
Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten-password recovery mechanism (CWE-640) that a remote, unauthenticated attacker can manipulate to assume ownership of another user's account. The flaw carries a CVSS 9.8 rating because it is network-reachable with no authentication or user interaction, yielding full compromise of confidentiality, integrity, and availability of the targeted account. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), and CISA's SSVC framework records exploitation as none, indicating no observed in-the-wild activity despite the critical score.
Unauthenticated file disclosure in Esri ArcGIS Server (all versions 12.0 and prior) lets remote attackers read sensitive files by supplying crafted path parameters that escape the intended directory. The flaw is network-reachable with no authentication or user interaction and, per CISA's SSVC framework, is automatable with total technical impact, though no public exploit has been identified and EPSS exploitation probability remains modest at 0.72%. Esri disclosed and patched the issue in its May 2026 ArcGIS security bulletin.
Unrestricted file upload in Esri ArcGIS Server (all versions through 12.0) lets a remote, unauthenticated attacker push arbitrary files to an exposed administrative/upload endpoint, per CVSS PR:N. Esri self-reported the flaw (CWE-434) and rates it critical (CVSS 9.8), and successful upload of an executable payload can lead to full server compromise. There is no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile), indicating it is not yet a mass-exploitation target.
Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly validate the permissions bound to developer credentials, allowing a holder of such credentials to access resources or perform actions beyond their intended authorization. The vendor rates it CVSS 9.8 (network, no privileges, no interaction), though the description's reference to 'developer credentials' implies some prior credential is involved. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), but SSVC flags the technical impact as total and the flaw as automatable.
Privilege escalation in Esri Portal for ArcGIS 11.5 on Windows and Linux allows highly privileged users to mint developer credentials (API keys/OAuth application credentials) that carry more privileges than the issuing account should be able to delegate, breaking the platform's privilege boundary. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total and automatable. Note a significant signal conflict: the published CVSS 9.8 vector uses PR:N (unauthenticated) while the vendor description explicitly requires a 'highly privileged' user, which materially lowers the realistic risk.
Reflected cross-site scripting in Esri Portal for ArcGIS 12.1 and earlier allows a remote, unauthenticated attacker to craft a link that, when clicked by a victim, executes arbitrary JavaScript in that victim's browser context. Rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CWE-79), the flaw requires victim interaction - the attacker-supplied link must actually be clicked - and the resulting impact is confined to the low-privilege browser session rather than server-side compromise. There is no CISA KEV entry and no public exploit identified at time of analysis; Esri rates the issue as a this-month priority rather than an emergency, reflecting a genuine but non-urgent patching task for administrators running the affected Portal versions.
Stored cross-site scripting in Esri ArcGIS Server 11.1 and earlier on Windows and Linux lets a remote unauthenticated attacker in certain susceptible configurations store files containing malicious code that then executes in a victim's browser when that content is loaded, requiring victim interaction (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C). Impact is confined to the victim's browser session rather than the server itself, and exploitation depends on a non-default or specific configuration whose exact upload path or enabling setting is not described in available sources. No public exploit code or confirmed active exploitation is identified, and the vendor has issued patches in the October 2026 ArcGIS security bulletin for the 12.1, 12.0, 11.5, 11.3, and 11.1 branches.
Service metadata tampering in Esri ArcGIS Server 11.3 through 12.0 allows a remote, unauthenticated attacker with network reachability to update service metadata without user interaction, affecting integrity only (CVSS 5.3). The vendor restricts the affected window to 11.3-12.0 and provides patches for 12.0, 11.5, and 11.3; no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate, this-month remediation priority rather than an emergency.
Reflected cross-site scripting (CWE-79) in Esri Portal for ArcGIS 12.1 and earlier allows a remote, unauthenticated attacker to craft a link that, when clicked by a victim, can execute arbitrary JavaScript in that victim's browser context. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N): the attack is network-delivered and requires no attacker credentials, but success depends entirely on user interaction, and impact is bounded by a scope change with low confidentiality and integrity effects and no availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Esri has published a patched ArcGIS Server 11.5 line for versions in General Availability and Extended support.
Unauthenticated account creation in Esri Portal for ArcGIS allows remote attackers to register new portal accounts even when self-service signup has been explicitly disabled (disableSignup=true), by manipulating the signup workflow exposed through the portal's sharing endpoint. The flaw is reachable over the network with no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), which makes internet-exposed portals - and especially those whose operators deliberately disabled self-service registration for security reasons - the most realistic targets; the practical impact is bounded by whatever content and privileges a default new member receives. This is a moderate-severity authorization weakness (CWE-863) rather than a top-tier emergency, with a limited integrity impact and no confirmed confidentiality or availability impact; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so it is not confirmed as actively exploited.
LDAP injection in Esri Portal for ArcGIS allows an authenticated administrator to tamper with directory search queries built by administrative functionality, causing unintended Active Directory or LDAP operations against the connected directory service. The flaw is network-reachable with low complexity and requires no user interaction, but it is gated behind high administrative privileges (PR:H) and only materializes when the portal is configured to integrate with an external AD/LDAP identity store. Impact is weighted toward information disclosure (C:H) with limited integrity effects (I:L) and no availability impact; no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Overall this is a moderate-severity, operationally-constrained issue rather than a top-tier emergency.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior enables a remotely authenticated administrator to inject persistent malicious JavaScript that executes in other users' browsers upon page load. The scope change (S:C) in the CVSS vector confirms the attacker's injected payload crosses from the server context into victims' browser sessions, enabling session hijacking, credential theft, or DOM manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; Esri has issued a patch via the August 2026 ArcGIS security bulletin.
Reflected cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote, unauthenticated attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The CVSS Scope:Changed metric indicates that injected scripts may affect components beyond the vulnerable Portal itself, such as session tokens shared across an ArcGIS Enterprise deployment. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV.
Stored XSS in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker to inject persistent malicious scripts that execute in a victim's browser upon visiting affected portal content. Successful exploitation can yield session hijacking, credential theft, and unauthorized actions performed within a victim's authenticated portal session. No public exploit has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 12.1 enables a remote, privileged attacker to persist malicious JavaScript in the portal, which then executes in the browsers of users who subsequently view the affected content. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) with scope change (S:C), meaning successful exploitation crosses trust boundaries into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, and Esri has released patches via their August 2026 ArcGIS Security Bulletin.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.3 enables a remote attacker holding administrative credentials to insert arbitrary HTML into an administrative API endpoint, with potential to mislead or deceive other administrators viewing the rendered output. The CVSS score of 3.8 (Low) reflects the high privilege prerequisite (PR:H), which confines realistic exploitation to scenarios involving compromised admin accounts, rogue insiders, or privilege escalation chains. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote attacker holding high portal privileges to persist malicious JavaScript payloads in portal content. When any other authenticated user browses the affected item, the injected script executes in their browser, enabling session hijacking, credential exfiltration, or portal actions performed on the victim's behalf. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis; however, the CVSS scope-change metric (S:C) signals that impact crosses the security boundary of the vulnerable component and extends to victims' browser sessions.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 allows a remote, privileged attacker to persist malicious JavaScript within the portal, which subsequently executes in the browsers of any user who views the affected content. The vulnerability carries a CVSS 3.1 score of 5.5 with scope change (S:C), reflecting that exploitation crosses from the portal server into victim browser sessions, enabling session hijacking, credential harvesting, or unauthorized portal actions on behalf of victims. No public exploit code or CISA KEV listing has been identified at time of analysis, but Esri has released patches for affected enterprise versions and advises upgrading to the latest long-term support release.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker holding administrative credentials to persistently inject malicious JavaScript that executes in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload escapes the application's trust boundary and can affect lower-privileged users who simply load poisoned portal pages. No public exploit code or active exploitation has been identified at time of analysis; Esri has released guidance directing affected users to patch via the August 2026 ArcGIS Security Bulletin.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 12.0 enables a remote authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application, potentially exposing other portal users to malicious content. The flaw is tagged as XSS and classified under CWE-79, meaning unsanitized attacker-controlled input is rendered in the browser context of other users visiting the Home application. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified, though the relatively low privilege requirement (authenticated, low-privilege user) broadens the potential attacker pool within any ArcGIS Enterprise deployment.
Missing authentication in Esri Portal for ArcGIS versions 11.1 through 12.0 permits a remote unauthenticated attacker to read a specific internal resource intended to be access-controlled. The flaw (CWE-306) means one or more endpoints fail to enforce authentication before returning protected content, though the exposed resource is explicitly scoped to non-user data. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 5.3 Medium rating reflects the bounded confidentiality-only impact.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote, highly privileged attacker to insert arbitrary HTML into the Portal Home application, potentially delivering spoofed UI content or phishing material to other authenticated users. The CVSS vector (PR:H, UI:R, S:U) substantially constrains real-world impact: exploitation demands administrative-level credentials and victim interaction, with no availability impact and limited confidentiality or integrity effect. No public exploit code or active exploitation has been identified at time of analysis.
Open redirect vulnerability in ArcGIS Server 11.5 allows an attacker to craft a malicious login-workflow URL that, upon user authentication, silently redirects the victim's browser to an attacker-controlled external site. The flaw lies in insufficient input validation of the redirect parameter within the login redirection workflow, with impact explicitly limited to client-side browser navigation - no server-side compromise or cross-component data exposure is possible. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified at time of analysis, and EPSS data was not present in the available intelligence feed.
Improper authentication on an undocumented administrative endpoint in ArcGIS Server 11.1 through 12.0 allows unauthenticated remote attackers to disrupt the web-based browsing interface by sending a crafted HTTP request. The vulnerability is classified as CWE-287 and carries a CVSS 5.3 medium score, reflecting network-reachable, zero-privilege exploitation offset by limited impact (integrity only, no confidentiality or availability loss). No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in ArcGIS Pro 3.6.0 and earlier allows local attackers to inject malicious scripts into application dialogs that execute when opened by users with standard local access. No patch is currently available, and exploitation requires user interaction with a specific dialog containing attacker-supplied input. The vulnerability affects the desktop application only and poses a confidentiality and integrity risk without requiring elevated privileges.
Stored cross-site scripting (XSS) in Esri ArcGIS Server 11.4 and earlier allows remote unauthenticated attackers to store malicious content that executes in a victim's browser, but exploitation requires the victim to view the stored content (UI:R) and a specific non-default vulnerable configuration. No public exploit identified at time of analysis. A vendor patch (Security 2025 Update 2) is available.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to store files containing malicious code that executes in a victim's browser when loaded. Exploitation requires specific non-default configurations and victim interaction, limiting real-world risk; no public exploit code or active exploitation has been identified at time of analysis. The vulnerability is rated CVSS 6.1 (Medium).
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows remote unauthenticated attackers to persist files containing malicious script that later executes in the browser of a victim who opens the stored content, yielding script execution in the victim's browser context rather than on the server. The issue is scoped by the vendor to 'some configurations,' so default or hardened deployments may not expose the unauthenticated file-storage path, and exploitation requires victim interaction (UI:R) - a legitimate user must subsequently view the attacker-supplied content for the payload to fire. Impact is limited to Low confidentiality and Low integrity with no availability effect (CVSS 3.1 6.1, scope-changed), there is no public exploit identified at time of analysis, and a vendor patch is available per the Esri Trust ArcGIS advisory, making this a legitimate but moderate-severity issue rather than a top-tier emergency.
ArcGIS Server versions 11.5 and earlier on Windows and Linux are affected by an unrestricted file upload vulnerability (CWE-434) that allows unauthenticated, network-based attackers to upload arbitrary files, but architectural controls confine uploads to non-executable directories, preventing code execution, privilege escalation, or sensitive data access. Exploitation is further complicated by high attack complexity (AC:H), requiring a race condition, secret value, or man-in-the-middle position, and yields only low confidentiality, integrity, and availability impact. No public exploit code has been identified, and a vendor patch is available.
Unrestricted file upload in Esri ArcGIS Server 11.5 and earlier on Windows and Linux allows remote, unauthenticated attackers to write arbitrary files into the server's designated upload directories. The server architecture confines uploaded content to non-executable storage and prevents replacement or modification of existing application components and system configuration, so there is no path to code execution, privilege escalation, or sensitive data access; exploitation also requires a race condition, knowledge of secret values, or a man-in-the-middle position, and no public exploit code was identified at time of analysis. Our assessment narrows the impact to integrity-only (C:N/I:L/A:N), making this a low-priority issue despite the CWE-434 unrestricted-upload classification.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux lets a remote, unauthenticated attacker persist malicious script through a server endpoint that later executes in the browser context of any user or administrator who loads the poisoned content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium, CWE-79). Exploitation is not universal: it depends on the unspecified 'some configurations' the vendor references and is gated on victim interaction (UI:R), so impact is limited to client-side script execution in the victim's browser session rather than server compromise. Patch available per vendor advisory in the ArcGIS Server Security 2025 Update 2 Patch; no public exploit code was identified at time of analysis.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to plant files containing malicious code that later executes in a victim's browser when the affected page is viewed. Exploitation is limited to instances running in one of the affected non-default configurations and requires victim interaction (the user must load the page hosting the stored payload), so the impact is confined to the victim's browser session (scope change) rather than direct server compromise, giving a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE as confirmed actively exploited.
Stored cross-site scripting (CWE-79) in Esri ArcGIS Server 11.4 and earlier on Windows and Linux enables a remote unauthenticated attacker (PR:N) to store files containing malicious code that executes in a victim's browser when the stored content is viewed (UI:R), but only in certain non-default configurations according to the vendor. The impact is limited to the victim's browser context (C:L/I:L, no availability impact), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Esri has released a patch referenced in the ArcGIS Server Security 2025 Update 2 advisory.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 - 11.4 that may allow a remote, authenticated attacker to inject malicious a file with. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 - 11.4 that may allow a remote, authenticated attacker to inject malicious a file with. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 - 11.4 that may allow a remote, authenticated attacker to inject malicious a file with. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 - 11.4 that may allow a remote, authenticated attacker to inject malicious a file with. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial of service in Esri ArcGIS Server 12.0 and earlier can occur when crafted requests exhaust all available worker threads, denying service to legitimate users. The issue is remotely reachable without authentication or user interaction, but Esri describes the thread exhaustion as occurring only under exceptional circumstances and does not specify the exact trigger. Patches are available for the General Availability and Extended support branches 12.0, 11.5, 11.3, and 11.1; no public exploit was identified at time of analysis.
SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux allows remote attackers to invoke database-specific functions that should not be permitted, with high confidentiality, integrity, and availability impact. In default deployments the attacker must hold privileges to access the targeted service; fully anonymous exploitation is possible only when a service is explicitly configured in the non-default 'public' access mode, so realistic exposure is lower than the input 9.8 base score suggests. The vendor has released patches for 12.1, 12.0, 11.5, 11.3, and 11.1, and no public exploit is identified in the supplied data.
Unauthenticated access to administrative API endpoints in Esri Portal for ArcGIS can let remote attackers reach /portaladmin/local functionality that should require authentication, potentially exposing portal administration with high confidentiality, integrity, and availability impact. Exploitation is conditional - the independent assessment rates CVSS 3.1 as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning high impact but dependent on unspecified portal configuration conditions, while the vendor input vector is 9.8 with AC:L - and no public exploit has been identified at time of analysis. Affected product is Portal for ArcGIS, tracked by CPE cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*; consult Esri's September 2026 bulletin for exact affected versions and fixes.
Heap-based out-of-bounds write in the Esri LERC raster library 4.1.0 and earlier lets a remote, unauthenticated attacker crash an application that decodes attacker-supplied LERC imagery, resulting in a denial of service. Exploitation is possible only where a consuming application exposes a decode path for untrusted LERC input (for example imagery uploads, tile requests, or raster ingestion pipelines); the library is not a network service itself, so reachability is entirely dependent on the host application, and impact is confined to a process crash with no confirmed route to code execution or data disclosure. No public exploit code was identified at time of analysis and the issue has not been confirmed as actively exploited (CISA KEV); CVSS 3.1 scores it 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact requiring no privileges or user interaction on a reachable decode path.
Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 allows remote unauthenticated attackers to extract sensitive data reflected in HTTP response bodies via crafted requests. The vulnerability (CWE-200) requires no authentication or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, meaning any internet-exposed Portal instance in the affected version range is potentially reachable without credentials. No public exploit or KEV listing exists at time of analysis, and SSVC classifies exploitation as none with partial technical impact, indicating limited observed threat activity despite the high confidentiality impact scored by NVD.
Sensitive information reflection in Esri Portal for ArcGIS versions 11.1 through 12.0 exposes confidential content in HTTP response bodies to remote, unauthenticated attackers under specific, difficult-to-reproduce conditions. The vulnerability stems from improper information exposure (CWE-200), where a crafted request can cause the server to echo sensitive data back in its response. No active exploitation has been confirmed, and EPSS probability is low at 0.33%, though CVSS rates confidentiality impact as high given the potential sensitivity of reflected data.
Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a critical API endpoint that a remote, unauthenticated attacker can reach directly, bypassing access controls to interact with functionality that should require an authenticated session. Esri rates this critical (CVSS 9.8) and disclosed it in its June 2026 ArcGIS security bulletin; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the exposed function is an administrative/portal API reachable over the network with no credentials, successful access could lead to disclosure or manipulation of portal content and configuration.
Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten-password recovery mechanism (CWE-640) that a remote, unauthenticated attacker can manipulate to assume ownership of another user's account. The flaw carries a CVSS 9.8 rating because it is network-reachable with no authentication or user interaction, yielding full compromise of confidentiality, integrity, and availability of the targeted account. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), and CISA's SSVC framework records exploitation as none, indicating no observed in-the-wild activity despite the critical score.
Unauthenticated file disclosure in Esri ArcGIS Server (all versions 12.0 and prior) lets remote attackers read sensitive files by supplying crafted path parameters that escape the intended directory. The flaw is network-reachable with no authentication or user interaction and, per CISA's SSVC framework, is automatable with total technical impact, though no public exploit has been identified and EPSS exploitation probability remains modest at 0.72%. Esri disclosed and patched the issue in its May 2026 ArcGIS security bulletin.
Unrestricted file upload in Esri ArcGIS Server (all versions through 12.0) lets a remote, unauthenticated attacker push arbitrary files to an exposed administrative/upload endpoint, per CVSS PR:N. Esri self-reported the flaw (CWE-434) and rates it critical (CVSS 9.8), and successful upload of an executable payload can lead to full server compromise. There is no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile), indicating it is not yet a mass-exploitation target.
Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly validate the permissions bound to developer credentials, allowing a holder of such credentials to access resources or perform actions beyond their intended authorization. The vendor rates it CVSS 9.8 (network, no privileges, no interaction), though the description's reference to 'developer credentials' implies some prior credential is involved. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), but SSVC flags the technical impact as total and the flaw as automatable.
Privilege escalation in Esri Portal for ArcGIS 11.5 on Windows and Linux allows highly privileged users to mint developer credentials (API keys/OAuth application credentials) that carry more privileges than the issuing account should be able to delegate, breaking the platform's privilege boundary. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total and automatable. Note a significant signal conflict: the published CVSS 9.8 vector uses PR:N (unauthenticated) while the vendor description explicitly requires a 'highly privileged' user, which materially lowers the realistic risk.
Reflected cross-site scripting in Esri Portal for ArcGIS 12.1 and earlier allows a remote, unauthenticated attacker to craft a link that, when clicked by a victim, executes arbitrary JavaScript in that victim's browser context. Rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CWE-79), the flaw requires victim interaction - the attacker-supplied link must actually be clicked - and the resulting impact is confined to the low-privilege browser session rather than server-side compromise. There is no CISA KEV entry and no public exploit identified at time of analysis; Esri rates the issue as a this-month priority rather than an emergency, reflecting a genuine but non-urgent patching task for administrators running the affected Portal versions.
Stored cross-site scripting in Esri ArcGIS Server 11.1 and earlier on Windows and Linux lets a remote unauthenticated attacker in certain susceptible configurations store files containing malicious code that then executes in a victim's browser when that content is loaded, requiring victim interaction (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C). Impact is confined to the victim's browser session rather than the server itself, and exploitation depends on a non-default or specific configuration whose exact upload path or enabling setting is not described in available sources. No public exploit code or confirmed active exploitation is identified, and the vendor has issued patches in the October 2026 ArcGIS security bulletin for the 12.1, 12.0, 11.5, 11.3, and 11.1 branches.
Service metadata tampering in Esri ArcGIS Server 11.3 through 12.0 allows a remote, unauthenticated attacker with network reachability to update service metadata without user interaction, affecting integrity only (CVSS 5.3). The vendor restricts the affected window to 11.3-12.0 and provides patches for 12.0, 11.5, and 11.3; no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate, this-month remediation priority rather than an emergency.
Reflected cross-site scripting (CWE-79) in Esri Portal for ArcGIS 12.1 and earlier allows a remote, unauthenticated attacker to craft a link that, when clicked by a victim, can execute arbitrary JavaScript in that victim's browser context. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N): the attack is network-delivered and requires no attacker credentials, but success depends entirely on user interaction, and impact is bounded by a scope change with low confidentiality and integrity effects and no availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Esri has published a patched ArcGIS Server 11.5 line for versions in General Availability and Extended support.
Unauthenticated account creation in Esri Portal for ArcGIS allows remote attackers to register new portal accounts even when self-service signup has been explicitly disabled (disableSignup=true), by manipulating the signup workflow exposed through the portal's sharing endpoint. The flaw is reachable over the network with no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), which makes internet-exposed portals - and especially those whose operators deliberately disabled self-service registration for security reasons - the most realistic targets; the practical impact is bounded by whatever content and privileges a default new member receives. This is a moderate-severity authorization weakness (CWE-863) rather than a top-tier emergency, with a limited integrity impact and no confirmed confidentiality or availability impact; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so it is not confirmed as actively exploited.
LDAP injection in Esri Portal for ArcGIS allows an authenticated administrator to tamper with directory search queries built by administrative functionality, causing unintended Active Directory or LDAP operations against the connected directory service. The flaw is network-reachable with low complexity and requires no user interaction, but it is gated behind high administrative privileges (PR:H) and only materializes when the portal is configured to integrate with an external AD/LDAP identity store. Impact is weighted toward information disclosure (C:H) with limited integrity effects (I:L) and no availability impact; no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Overall this is a moderate-severity, operationally-constrained issue rather than a top-tier emergency.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior enables a remotely authenticated administrator to inject persistent malicious JavaScript that executes in other users' browsers upon page load. The scope change (S:C) in the CVSS vector confirms the attacker's injected payload crosses from the server context into victims' browser sessions, enabling session hijacking, credential theft, or DOM manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; Esri has issued a patch via the August 2026 ArcGIS security bulletin.
Reflected cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote, unauthenticated attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The CVSS Scope:Changed metric indicates that injected scripts may affect components beyond the vulnerable Portal itself, such as session tokens shared across an ArcGIS Enterprise deployment. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV.
Stored XSS in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker to inject persistent malicious scripts that execute in a victim's browser upon visiting affected portal content. Successful exploitation can yield session hijacking, credential theft, and unauthorized actions performed within a victim's authenticated portal session. No public exploit has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 12.1 enables a remote, privileged attacker to persist malicious JavaScript in the portal, which then executes in the browsers of users who subsequently view the affected content. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) with scope change (S:C), meaning successful exploitation crosses trust boundaries into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, and Esri has released patches via their August 2026 ArcGIS Security Bulletin.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.3 enables a remote attacker holding administrative credentials to insert arbitrary HTML into an administrative API endpoint, with potential to mislead or deceive other administrators viewing the rendered output. The CVSS score of 3.8 (Low) reflects the high privilege prerequisite (PR:H), which confines realistic exploitation to scenarios involving compromised admin accounts, rogue insiders, or privilege escalation chains. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote attacker holding high portal privileges to persist malicious JavaScript payloads in portal content. When any other authenticated user browses the affected item, the injected script executes in their browser, enabling session hijacking, credential exfiltration, or portal actions performed on the victim's behalf. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis; however, the CVSS scope-change metric (S:C) signals that impact crosses the security boundary of the vulnerable component and extends to victims' browser sessions.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 allows a remote, privileged attacker to persist malicious JavaScript within the portal, which subsequently executes in the browsers of any user who views the affected content. The vulnerability carries a CVSS 3.1 score of 5.5 with scope change (S:C), reflecting that exploitation crosses from the portal server into victim browser sessions, enabling session hijacking, credential harvesting, or unauthorized portal actions on behalf of victims. No public exploit code or CISA KEV listing has been identified at time of analysis, but Esri has released patches for affected enterprise versions and advises upgrading to the latest long-term support release.
Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker holding administrative credentials to persistently inject malicious JavaScript that executes in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload escapes the application's trust boundary and can affect lower-privileged users who simply load poisoned portal pages. No public exploit code or active exploitation has been identified at time of analysis; Esri has released guidance directing affected users to patch via the August 2026 ArcGIS Security Bulletin.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 12.0 enables a remote authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application, potentially exposing other portal users to malicious content. The flaw is tagged as XSS and classified under CWE-79, meaning unsanitized attacker-controlled input is rendered in the browser context of other users visiting the Home application. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified, though the relatively low privilege requirement (authenticated, low-privilege user) broadens the potential attacker pool within any ArcGIS Enterprise deployment.
Missing authentication in Esri Portal for ArcGIS versions 11.1 through 12.0 permits a remote unauthenticated attacker to read a specific internal resource intended to be access-controlled. The flaw (CWE-306) means one or more endpoints fail to enforce authentication before returning protected content, though the exposed resource is explicitly scoped to non-user data. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 5.3 Medium rating reflects the bounded confidentiality-only impact.
HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote, highly privileged attacker to insert arbitrary HTML into the Portal Home application, potentially delivering spoofed UI content or phishing material to other authenticated users. The CVSS vector (PR:H, UI:R, S:U) substantially constrains real-world impact: exploitation demands administrative-level credentials and victim interaction, with no availability impact and limited confidentiality or integrity effect. No public exploit code or active exploitation has been identified at time of analysis.
Open redirect vulnerability in ArcGIS Server 11.5 allows an attacker to craft a malicious login-workflow URL that, upon user authentication, silently redirects the victim's browser to an attacker-controlled external site. The flaw lies in insufficient input validation of the redirect parameter within the login redirection workflow, with impact explicitly limited to client-side browser navigation - no server-side compromise or cross-component data exposure is possible. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified at time of analysis, and EPSS data was not present in the available intelligence feed.
Improper authentication on an undocumented administrative endpoint in ArcGIS Server 11.1 through 12.0 allows unauthenticated remote attackers to disrupt the web-based browsing interface by sending a crafted HTTP request. The vulnerability is classified as CWE-287 and carries a CVSS 5.3 medium score, reflecting network-reachable, zero-privilege exploitation offset by limited impact (integrity only, no confidentiality or availability loss). No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in ArcGIS Pro 3.6.0 and earlier allows local attackers to inject malicious scripts into application dialogs that execute when opened by users with standard local access. No patch is currently available, and exploitation requires user interaction with a specific dialog containing attacker-supplied input. The vulnerability affects the desktop application only and poses a confidentiality and integrity risk without requiring elevated privileges.
Stored cross-site scripting (XSS) in Esri ArcGIS Server 11.4 and earlier allows remote unauthenticated attackers to store malicious content that executes in a victim's browser, but exploitation requires the victim to view the stored content (UI:R) and a specific non-default vulnerable configuration. No public exploit identified at time of analysis. A vendor patch (Security 2025 Update 2) is available.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to store files containing malicious code that executes in a victim's browser when loaded. Exploitation requires specific non-default configurations and victim interaction, limiting real-world risk; no public exploit code or active exploitation has been identified at time of analysis. The vulnerability is rated CVSS 6.1 (Medium).
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows remote unauthenticated attackers to persist files containing malicious script that later executes in the browser of a victim who opens the stored content, yielding script execution in the victim's browser context rather than on the server. The issue is scoped by the vendor to 'some configurations,' so default or hardened deployments may not expose the unauthenticated file-storage path, and exploitation requires victim interaction (UI:R) - a legitimate user must subsequently view the attacker-supplied content for the payload to fire. Impact is limited to Low confidentiality and Low integrity with no availability effect (CVSS 3.1 6.1, scope-changed), there is no public exploit identified at time of analysis, and a vendor patch is available per the Esri Trust ArcGIS advisory, making this a legitimate but moderate-severity issue rather than a top-tier emergency.
ArcGIS Server versions 11.5 and earlier on Windows and Linux are affected by an unrestricted file upload vulnerability (CWE-434) that allows unauthenticated, network-based attackers to upload arbitrary files, but architectural controls confine uploads to non-executable directories, preventing code execution, privilege escalation, or sensitive data access. Exploitation is further complicated by high attack complexity (AC:H), requiring a race condition, secret value, or man-in-the-middle position, and yields only low confidentiality, integrity, and availability impact. No public exploit code has been identified, and a vendor patch is available.
Unrestricted file upload in Esri ArcGIS Server 11.5 and earlier on Windows and Linux allows remote, unauthenticated attackers to write arbitrary files into the server's designated upload directories. The server architecture confines uploaded content to non-executable storage and prevents replacement or modification of existing application components and system configuration, so there is no path to code execution, privilege escalation, or sensitive data access; exploitation also requires a race condition, knowledge of secret values, or a man-in-the-middle position, and no public exploit code was identified at time of analysis. Our assessment narrows the impact to integrity-only (C:N/I:L/A:N), making this a low-priority issue despite the CWE-434 unrestricted-upload classification.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux lets a remote, unauthenticated attacker persist malicious script through a server endpoint that later executes in the browser context of any user or administrator who loads the poisoned content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium, CWE-79). Exploitation is not universal: it depends on the unspecified 'some configurations' the vendor references and is gated on victim interaction (UI:R), so impact is limited to client-side script execution in the victim's browser session rather than server compromise. Patch available per vendor advisory in the ArcGIS Server Security 2025 Update 2 Patch; no public exploit code was identified at time of analysis.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to plant files containing malicious code that later executes in a victim's browser when the affected page is viewed. Exploitation is limited to instances running in one of the affected non-default configurations and requires victim interaction (the user must load the page hosting the stored payload), so the impact is confined to the victim's browser session (scope change) rather than direct server compromise, giving a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE as confirmed actively exploited.
Stored cross-site scripting (CWE-79) in Esri ArcGIS Server 11.4 and earlier on Windows and Linux enables a remote unauthenticated attacker (PR:N) to store files containing malicious code that executes in a victim's browser when the stored content is viewed (UI:R), but only in certain non-default configurations according to the vendor. The impact is limited to the victim's browser context (C:L/I:L, no availability impact), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Esri has released a patch referenced in the ArcGIS Server Security 2025 Update 2 advisory.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 - 11.4 that may allow a remote, authenticated attacker to inject malicious a file with. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 - 11.4 that may allow a remote, authenticated attacker to inject malicious a file with. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 - 11.4 that may allow a remote, authenticated attacker to inject malicious a file with. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 - 11.4 that may allow a remote, authenticated attacker to inject malicious a file with. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.