What’s Vulnerable › Products

Esri ArcGIS Server vulnerabilities

75 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 43 published in the last 12 months.

Check whether your Esri ArcGIS Server version is affected

Latest Esri ArcGIS Server vulnerabilities

• CVE-2026-50096 — BUG-000187164 - ArcGIS Server has a security vulnerability. (CVSS 6.1)
• CVE-2026-50095 — BUG-000187165 - ArcGIS Server has a security vulnerability. (CVSS 6.1)
• CVE-2026-33522 — BUG-000182936 - ArcGIS Server has a security vulnerability. (CVSS 5.3)
• CVE-2026-33521 — BUG-000186514 - ArcGIS Server has a security vulnerability. (CVSS 7.5)
• CVE-2026-33520 — BUG-000185167 - ArcGIS Server has a security vulnerability. (CVSS 6.1)
• CVE-2026-10757 — BUG-000187511 - ArcGIS Server has a security vulnerability. (CVSS 9.8)
• CVE-2026-9182 — Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 9.8)
• CVE-2026-9181 — Directory Traversal in ArcGIS Server (CVSS 7.5)
• CVE-2026-2813 — Unvalidated Redirect in ArcGIS Server (CVSS 4.1)
• CVE-2026-2812 — Improper Authentication issue in ArcGIS Server (CVSS 5.3)
• CVE-2025-67711 — Reflected XSS vulnerability in ArcGIS Server. (CVSS 6.1)
• CVE-2025-67710 — Stored XSS vulnerability in ArcGIS Server (CVSS 6.1)
• CVE-2025-67709 — There is a cross site scripting issue in ArcGIS Server. (CVSS 6.1)
• CVE-2025-67708 — Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server. (CVSS 6.1)
• CVE-2025-67707 — Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 5.6)
• CVE-2025-67706 — Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 5.6)
• CVE-2025-67705 — Reflected XSS vulnerability in ArcGIS Server. (CVSS 6.1)
• CVE-2025-67704 — Stored XSS vulnerability in ArcGIS Server. (CVSS 6.1)
• CVE-2025-67703 — Stored XSS vulnerability in ArcGIS Server. (CVSS 6.1)
• CVE-2025-57870 — BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services. (CVSS 10.0)
• CVE-2024-5888 — Stored XSS in Rest Services API for a Toolbox published as GP Service (CVSS 4.8)
• CVE-2024-51966 — Directory traversal vulnerability in ArcGIS Server (CVSS 4.9)
• CVE-2024-51963 — Stored XSS in ArcGIS Server Manager (CVSS 4.8)
• CVE-2024-51962 — SQL injection vulnerability in ArcGIS Server (CVSS 8.7)
• CVE-2024-51961 — Local file inclusion (LFI) vulnerability in ArcGIS Server (CVSS 7.5)