163
CVEs
13
Critical
31
High
0
KEV
4
PoC
40
Unpatched C/H
13.5%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
13
HIGH
31
MEDIUM
115
LOW
4
Monthly CVE Trend
Affected Products (19)
Portal For Arcgis
88
Arcgis Server
59
Open Redirect
11
Arcgis Pro
6
Arcgis Enterprise
5
Kubernetes
4
Arcmap
4
Arcgis Engine
3
Arcreader
3
Arcgis Insights
2
Arcgis Allsource
2
Jwt Attack
1
Arcgis For Desktop
1
Arcgis Earth
1
Arcgis For Engine
1
Windows
1
Arcgis Geoevent Server
1
PHP
1
Arcgis Quickcapture
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2012-1661 | ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available. | CRITICAL | 9.3 | 1.2% | 68 |
PoC
No patch
|
| CVE-2012-4949 | SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 1.3% | 54 |
PoC
No patch
|
| CVE-2024-25693 | There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 9.9 | 1.3% | 50 |
No patch
|
| CVE-2026-13019 | Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a critical API endpoint that a remote, unauthenticated attacker can reach directly, bypassing access controls to interact with functionality that should require an authenticated session. Esri rates this critical (CVSS 9.8) and disclosed it in its June 2026 ArcGIS security bulletin; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the exposed function is an administrative/portal API reachable over the network with no credentials, successful access could lead to disclosure or manipulation of portal content and configuration. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-13020 | Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten-password recovery mechanism (CWE-640) that a remote, unauthenticated attacker can manipulate to assume ownership of another user's account. The flaw carries a CVSS 9.8 rating because it is network-reachable with no authentication or user interaction, yielding full compromise of confidentiality, integrity, and availability of the targeted account. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), and CISA's SSVC framework records exploitation as none, indicating no observed in-the-wild activity despite the critical score. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2025-2538 | A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-33519 | Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly validate the permissions bound to developer credentials, allowing a holder of such credentials to access resources or perform actions beyond their intended authorization. The vendor rates it CVSS 9.8 (network, no privileges, no interaction), though the description's reference to 'developer credentials' implies some prior credential is involved. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), but SSVC flags the technical impact as total and the flaw as automatable. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-33518 | Privilege escalation in Esri Portal for ArcGIS 11.5 on Windows and Linux allows highly privileged users to mint developer credentials (API keys/OAuth application credentials) that carry more privileges than the issuing account should be able to delegate, breaking the platform's privilege boundary. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total and automatable. Note a significant signal conflict: the published CVSS 9.8 vector uses PR:N (unauthenticated) while the vendor description explicitly requires a 'highly privileged' user, which materially lowers the realistic risk. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2020-35712 | Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.6% | 49 |
No patch
|
| CVE-2021-29114 | A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.0% | 49 |
No patch
|
| CVE-2022-38193 | There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.6 | 0.7% | 48 |
No patch
|
| CVE-2021-3012 | A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.4 | 0.7% | 47 |
PoC
No patch
|
| CVE-2021-29102 | A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.1 | 1.6% | 46 |
No patch
|
| CVE-2021-29108 | There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.8% | 44 |
No patch
|
| CVE-2023-25832 | There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user into executing unwanted actions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.3% | 44 |
No patch
|