# Esri ArcGIS Server.

Every CVE that names Esri ArcGIS Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [BUG-000187164 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-50096.md)
  `CVE-2026-50096` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [BUG-000187165 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-50095.md)
  `CVE-2026-50095` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [BUG-000182936 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-33522.md)
  `CVE-2026-33522` · CVE record: Esri ArcGIS Server · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [BUG-000186514 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-33521.md)
  `CVE-2026-33521` · CVE record: Esri ArcGIS Server · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service
- [BUG-000185167 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-33520.md)
  `CVE-2026-33520` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [BUG-000187511 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-10757.md)
  `CVE-2026-10757` · CVE record: Esri ArcGIS Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection
- [Directory Traversal in ArcGIS Server](https://agentprime.io/advisories/CVE-2026-9181.md)
  `CVE-2026-9181` · CVE record: Esri ArcGIS Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Path traversal
- [Unvalidated File Upload vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2026-9182.md)
  `CVE-2026-9182` · CVE record: Esri ArcGIS Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Unrestricted file upload
- [Unvalidated Redirect in ArcGIS Server](https://agentprime.io/advisories/CVE-2026-2813.md)
  `CVE-2026-2813` · CVE record: Esri ArcGIS Server · CVSS 4.7 Medium · Not analysed yet · Published 20 May 2026
- [Improper Authentication issue in ArcGIS Server](https://agentprime.io/advisories/CVE-2026-2812.md)
  `CVE-2026-2812` · CVE record: Esri ArcGIS Server · CVSS 5.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: Authentication bypass
- [Reflected XSS vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2025-67711.md)
  `CVE-2025-67711` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS vulnerability in ArcGIS Server](https://agentprime.io/advisories/CVE-2025-67710.md)
  `CVE-2025-67710` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS)
- [There is a cross site scripting issue in ArcGIS Server.](https://agentprime.io/advisories/CVE-2025-67709.md)
  `CVE-2025-67709` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2025-67708.md)
  `CVE-2025-67708` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Unvalidated File Upload vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2025-67707.md)
  `CVE-2025-67707` · CVE record: Esri ArcGIS Server · CVSS 5.6 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Unrestricted file upload
- [Unvalidated File Upload vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2025-67706.md)
  `CVE-2025-67706` · CVE record: Esri ArcGIS Server · CVSS 5.6 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Unrestricted file upload
- [Reflected XSS vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2025-67705.md)
  `CVE-2025-67705` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2025-67704.md)
  `CVE-2025-67704` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2025-67703.md)
  `CVE-2025-67703` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS)
- [BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.](https://agentprime.io/advisories/CVE-2025-57870.md)
  `CVE-2025-57870` · CVE record: Esri ArcGIS Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2025 · Tags: SQL injection
- [Directory traversal vulnerability in ArcGIS Server](https://agentprime.io/advisories/CVE-2024-51966.md)
  `CVE-2024-51966` · CVE record: Esri ArcGIS Server · CVSS 4.9 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Path traversal
- [Stored XSS in ArcGIS Server Manager](https://agentprime.io/advisories/CVE-2024-51963.md)
  `CVE-2024-51963` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [SQL injection vulnerability in ArcGIS Server](https://agentprime.io/advisories/CVE-2024-51962.md)
  `CVE-2024-51962` · CVE record: Esri ArcGIS Server · CVSS 8.7 High · Not analysed yet · Published 3 Mar 2025 · Tags: SQL injection
- [Local file inclusion (LFI) vulnerability in ArcGIS Server](https://agentprime.io/advisories/CVE-2024-51961.md)
  `CVE-2024-51961` · CVE record: Esri ArcGIS Server · CVSS 7.5 High · Not analysed yet · Published 3 Mar 2025 · Tags: Path traversal
- [Stored XSS in ArcGIS Server Administrator Directory](https://agentprime.io/advisories/CVE-2024-51960.md)
  `CVE-2024-51960` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS issue in Server Admin API](https://agentprime.io/advisories/CVE-2024-51959.md)
  `CVE-2024-51959` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Directory traversal vulnerability in the admin api for service thumbnails](https://agentprime.io/advisories/CVE-2024-51958.md)
  `CVE-2024-51958` · CVE record: Esri ArcGIS Server · CVSS 4.9 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Path traversal
- [Stored XSS vulnerability in ArcGIS Rest Services Directory](https://agentprime.io/advisories/CVE-2024-51957.md)
  `CVE-2024-51957` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS vulnerability in ArcGIS Server Administrator Directory](https://agentprime.io/advisories/CVE-2024-51956.md)
  `CVE-2024-51956` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Unauthorized access to secure services in ArcGIS Server](https://agentprime.io/advisories/CVE-2024-51954.md)
  `CVE-2024-51954` · CVE record: Esri ArcGIS Server · CVSS 8.5 High · Not analysed yet · Published 3 Mar 2025 · Tags: Broken access control
- [Stored XSS in ArcGIS Server Rest services](https://agentprime.io/advisories/CVE-2024-51953.md)
  `CVE-2024-51953` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS issue in ArcGIS Server](https://agentprime.io/advisories/CVE-2024-51952.md)
  `CVE-2024-51952` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Server Admin API](https://agentprime.io/advisories/CVE-2024-51951.md)
  `CVE-2024-51951` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Server Admin under Services > lifecycleinfos](https://agentprime.io/advisories/CVE-2024-51950.md)
  `CVE-2024-51950` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service](https://agentprime.io/advisories/CVE-2024-51949.md)
  `CVE-2024-51949` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS vulnerability in Rest Services under Job ID](https://agentprime.io/advisories/CVE-2024-51948.md)
  `CVE-2024-51948` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS vulnerability in Rest Services under Layer name](https://agentprime.io/advisories/CVE-2024-51947.md)
  `CVE-2024-51947` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Rest Services Directory under Identify operation](https://agentprime.io/advisories/CVE-2024-51946.md)
  `CVE-2024-51946` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS issues in Server Admin API](https://agentprime.io/advisories/CVE-2024-51945.md)
  `CVE-2024-51945` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Rest Services Directory](https://agentprime.io/advisories/CVE-2024-51944.md)
  `CVE-2024-51944` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page](https://agentprime.io/advisories/CVE-2024-51942.md)
  `CVE-2024-51942` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Server Admin API](https://agentprime.io/advisories/CVE-2024-10904.md)
  `CVE-2024-10904` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Rest Services API for a Toolbox published as GP Service](https://agentprime.io/advisories/CVE-2024-5888.md)
  `CVE-2024-5888` · CVE record: Esri ArcGIS Server · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Cross-site scripting (XSS)
- [BUG-000152121 - Directory traversal vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2022-38202.md)
  `CVE-2022-38202` · CVE record: Esri ArcGIS Server · CVSS 7.5 High · Not analysed yet · Published 28 Dec 2022 · Tags: Path traversal
- [BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server](https://agentprime.io/advisories/CVE-2022-38195.md)
  `CVE-2022-38195` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 25 Oct 2022 · Tags: Cross-site scripting (XSS)
- [BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability](https://agentprime.io/advisories/CVE-2022-38196.md)
  `CVE-2022-38196` · CVE record: Esri ArcGIS Server · CVSS 6.5 Medium · Not analysed yet · Published 25 Oct 2022 · Tags: Path traversal
- [BUG-000148347 Unvalidated redirect issues in ArcGIS Server.](https://agentprime.io/advisories/CVE-2022-38197.md)
  `CVE-2022-38197` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 25 Oct 2022 · Tags: Open redirect
- [BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server](https://agentprime.io/advisories/CVE-2022-38198.md)
  `CVE-2022-38198` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 25 Oct 2022 · Tags: Cross-site scripting (XSS)
- [BUG-000144172 - Remote file download issue in ArcGIS Server](https://agentprime.io/advisories/CVE-2022-38199.md)
  `CVE-2022-38199` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 25 Oct 2022 · Tags: CWE-494
- [BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.](https://agentprime.io/advisories/CVE-2022-38200.md)
  `CVE-2022-38200` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 25 Oct 2022 · Tags: Cross-site scripting (XSS)
- [BUG-000142180 Hosted feature services vulnerable to stored XSS](https://agentprime.io/advisories/CVE-2021-29116.md)
  `CVE-2021-29116` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 7 Dec 2021 · Tags: Cross-site scripting (XSS)
- [An information disclosure vulnerability](https://agentprime.io/advisories/CVE-2021-29115.md)
  `CVE-2021-29115` · CVE record: Esri ArcGIS Server · CVSS 5.3 Medium · Not analysed yet · Published 7 Dec 2021 · Tags: Information disclosure
- [SQL injection vulnerability in ArcGIS Server](https://agentprime.io/advisories/CVE-2021-29114.md)
  `CVE-2021-29114` · CVE record: Esri ArcGIS Server · CVSS 7.3 High · Not analysed yet · Published 7 Dec 2021 · Tags: SQL injection
- [Remote file inclusion vulnerability in ArcGIS Server help documentation](https://agentprime.io/advisories/CVE-2021-29113.md)
  `CVE-2021-29113` · CVE record: Esri ArcGIS Server · CVSS 4.7 Medium · Not analysed yet · Published 7 Dec 2021 · Tags: File inclusion
- [There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.](https://agentprime.io/advisories/CVE-2021-29104.md)
  `CVE-2021-29104` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 11 Jul 2021 · Tags: Cross-site scripting (XSS)
- [There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.](https://agentprime.io/advisories/CVE-2021-29102.md)
  `CVE-2021-29102` · CVE record: Esri ArcGIS Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jul 2021 · Tags: Server-side request forgery (SSRF)
- [There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.](https://agentprime.io/advisories/CVE-2021-29103.md)
  `CVE-2021-29103` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 11 Jul 2021 · Tags: Cross-site scripting (XSS)
- [There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.](https://agentprime.io/advisories/CVE-2021-29105.md)
  `CVE-2021-29105` · CVE record: Esri ArcGIS Server · CVSS 5.4 Medium · Not analysed yet · Published 11 Jul 2021 · Tags: Cross-site scripting (XSS)
- [There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.](https://agentprime.io/advisories/CVE-2021-29106.md)
  `CVE-2021-29106` · CVE record: Esri ArcGIS Server · CVSS 4.7 Medium · Not analysed yet · Published 10 Jul 2021 · Tags: Cross-site scripting (XSS)
- [There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.](https://agentprime.io/advisories/CVE-2021-29107.md)
  `CVE-2021-29107` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 10 Jul 2021 · Tags: Cross-site scripting (XSS)

Older: <https://agentprime.io/advisories/technology/esri-arcgis-server.md?cursor=WyIyMDIxLTA3LTEwVDE0OjIzOjQ1Ljg0NjAwMFoiLCJDVkUtMjAyMS0yOTEwNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=esri-arcgis-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/esri-arcgis-server/>. Everything for agents: <https://agentprime.io/llms.txt>.