Advisories · Technology

Esri ArcGIS Server.

Every CVE that names Esri ArcGIS Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-50096 CVE record

CVSS 6.1 Medium

BUG-000187164 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 26 Oct 2026
CVE-2026-50095 CVE record

CVSS 6.1 Medium

BUG-000187165 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 26 Oct 2026
CVE-2026-33522 CVE record

CVSS 5.3 Medium

BUG-000182936 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-33521 CVE record

CVSS 7.5 High

BUG-000186514 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Denial of service
Not analysed yet 26 Oct 2026
CVE-2026-33520 CVE record

CVSS 6.1 Medium

BUG-000185167 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 26 Oct 2026
CVE-2026-10757 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

BUG-000187511 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- SQL injection
Not analysed yet 26 Oct 2026
CVE-2026-9181 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Directory Traversal in ArcGIS Server
- Esri ArcGIS Server
- Path traversal
Not analysed yet 6 Jul 2026
CVE-2026-9182 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Unvalidated File Upload vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Unrestricted file upload
Not analysed yet 6 Jul 2026
CVE-2026-2813 CVE record

CVSS 4.7 Medium

Unvalidated Redirect in ArcGIS Server
- Esri ArcGIS Server
Not analysed yet 20 May 2026
CVE-2026-2812 CVE record

CVSS 5.3 Medium

Improper Authentication issue in ArcGIS Server
- Esri ArcGIS Server
- Authentication bypass
Not analysed yet 20 May 2026
CVE-2025-67711 CVE record

CVSS 6.1 Medium

Reflected XSS vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 31 Dec 2025
CVE-2025-67710 CVE record

CVSS 6.1 Medium

Stored XSS vulnerability in ArcGIS Server
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 31 Dec 2025
CVE-2025-67709 CVE record

CVSS 6.1 Medium

There is a cross site scripting issue in ArcGIS Server.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 31 Dec 2025
CVE-2025-67708 CVE record

CVSS 6.1 Medium

Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 31 Dec 2025
CVE-2025-67707 CVE record

CVSS 5.6 Medium

Unvalidated File Upload vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Unrestricted file upload
Not analysed yet 31 Dec 2025
CVE-2025-67706 CVE record

CVSS 5.6 Medium

Unvalidated File Upload vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Unrestricted file upload
Not analysed yet 31 Dec 2025
CVE-2025-67705 CVE record

CVSS 6.1 Medium

Reflected XSS vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 31 Dec 2025
CVE-2025-67704 CVE record

CVSS 6.1 Medium

Stored XSS vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 31 Dec 2025
CVE-2025-67703 CVE record

CVSS 6.1 Medium

Stored XSS vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 31 Dec 2025
CVE-2025-57870 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.
- Esri ArcGIS Server
- SQL injection
Not analysed yet 22 Oct 2025
CVE-2024-51966 CVE record

CVSS 4.9 Medium

Directory traversal vulnerability in ArcGIS Server
- Esri ArcGIS Server
- Path traversal
Not analysed yet 3 Mar 2025
CVE-2024-51963 CVE record

CVSS 4.8 Medium

Stored XSS in ArcGIS Server Manager
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51962 CVE record

CVSS 8.7 High

SQL injection vulnerability in ArcGIS Server
- Esri ArcGIS Server
- SQL injection
Not analysed yet 3 Mar 2025
CVE-2024-51961 CVE record

CVSS 7.5 High

Local file inclusion (LFI) vulnerability in ArcGIS Server
- Esri ArcGIS Server
- Path traversal
Not analysed yet 3 Mar 2025
CVE-2024-51960 CVE record

CVSS 4.8 Medium

Stored XSS in ArcGIS Server Administrator Directory
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51959 CVE record

CVSS 4.8 Medium

Stored XSS issue in Server Admin API
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51958 CVE record

CVSS 4.9 Medium

Directory traversal vulnerability in the admin api for service thumbnails
- Esri ArcGIS Server
- Path traversal
Not analysed yet 3 Mar 2025
CVE-2024-51957 CVE record

CVSS 4.8 Medium

Stored XSS vulnerability in ArcGIS Rest Services Directory
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51956 CVE record

CVSS 4.8 Medium

Stored XSS vulnerability in ArcGIS Server Administrator Directory
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51954 CVE record

CVSS 8.5 High

Unauthorized access to secure services in ArcGIS Server
- Esri ArcGIS Server
- Broken access control
Not analysed yet 3 Mar 2025
CVE-2024-51953 CVE record

CVSS 4.8 Medium

Stored XSS in ArcGIS Server Rest services
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51952 CVE record

CVSS 4.8 Medium

Stored XSS issue in ArcGIS Server
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51951 CVE record

CVSS 4.8 Medium

Stored XSS in Server Admin API
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51950 CVE record

CVSS 4.8 Medium

Stored XSS in Server Admin under Services > lifecycleinfos
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51949 CVE record

CVSS 4.8 Medium

Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51948 CVE record

CVSS 4.8 Medium

Stored XSS vulnerability in Rest Services under Job ID
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51947 CVE record

CVSS 4.8 Medium

Stored XSS vulnerability in Rest Services under Layer name
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51946 CVE record

CVSS 4.8 Medium

Stored XSS in Rest Services Directory under Identify operation
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51945 CVE record

CVSS 4.8 Medium

Stored XSS issues in Server Admin API
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51944 CVE record

CVSS 4.8 Medium

Stored XSS in Rest Services Directory
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51942 CVE record

CVSS 4.8 Medium

Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-10904 CVE record

CVSS 4.8 Medium

Stored XSS in Server Admin API
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-5888 CVE record

CVSS 4.8 Medium

Stored XSS in Rest Services API for a Toolbox published as GP Service
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2022-38202 CVE record

CVSS 7.5 High

BUG-000152121 - Directory traversal vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Path traversal
Not analysed yet 28 Dec 2022
CVE-2022-38195 CVE record

CVSS 6.1 Medium

BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 25 Oct 2022
CVE-2022-38196 CVE record

CVSS 6.5 Medium

BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability
- Esri ArcGIS Server
- Path traversal
Not analysed yet 25 Oct 2022
CVE-2022-38197 CVE record

CVSS 6.1 Medium

BUG-000148347 Unvalidated redirect issues in ArcGIS Server.
- Esri ArcGIS Server
- Open redirect
Not analysed yet 25 Oct 2022
CVE-2022-38198 CVE record

CVSS 6.1 Medium

BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 25 Oct 2022
CVE-2022-38199 CVE record

CVSS 6.1 Medium

BUG-000144172 - Remote file download issue in ArcGIS Server
- Esri ArcGIS Server
- CWE-494
Not analysed yet 25 Oct 2022
CVE-2022-38200 CVE record

CVSS 6.1 Medium

BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 25 Oct 2022
CVE-2021-29116 CVE record

CVSS 6.1 Medium

BUG-000142180 Hosted feature services vulnerable to stored XSS
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 7 Dec 2021
CVE-2021-29115 CVE record

CVSS 5.3 Medium

An information disclosure vulnerability
- Esri ArcGIS Server
- Information disclosure
Not analysed yet 7 Dec 2021
CVE-2021-29114 CVE record

CVSS 7.3 High

SQL injection vulnerability in ArcGIS Server
- Esri ArcGIS Server
- SQL injection
Not analysed yet 7 Dec 2021
CVE-2021-29113 CVE record

CVSS 4.7 Medium

Remote file inclusion vulnerability in ArcGIS Server help documentation
- Esri ArcGIS Server
- File inclusion
Not analysed yet 7 Dec 2021
CVE-2021-29104 CVE record

CVSS 6.1 Medium

There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 11 Jul 2021
CVE-2021-29102 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.
- Esri ArcGIS Server
- Server-side request forgery (SSRF)
Not analysed yet 11 Jul 2021
CVE-2021-29103 CVE record

CVSS 6.1 Medium

There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 11 Jul 2021
CVE-2021-29105 CVE record

CVSS 5.4 Medium

There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 11 Jul 2021
CVE-2021-29106 CVE record

CVSS 4.7 Medium

There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 10 Jul 2021
CVE-2021-29107 CVE record

CVSS 6.1 Medium

There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
Not analysed yet 10 Jul 2021