CVE-2026-10757: BUG-000187511 - ArcGIS Server has a security vulnerability.

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-29
Weakness: CWE-89

Description

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

Summary

CVE-2026-10757 is a critical SQL injection flaw (CVSS 9.8) in Esri ArcGIS Server 12.1 and earlier on Windows and Linux. A remote attacker with access to the service, potentially anonymous if the service is configured for public access, could invoke database functions that should not be allowed. No exploitation has been reported and it is not in CISA KEV. Patches are available for versions 12.1, 12.0, 11.5, 11.3, and 11.1; users on unlisted (mature or retired) versions should upgrade and apply the patch.

تُعد CVE-2026-10757 ثغرة حقن SQL حرجة (CVSS 9.8) في Esri ArcGIS Server الإصدار 12.1 والإصدارات الأقدم على Windows وLinux. قد يتمكن مهاجم عن بُعد لديه صلاحية الوصول إلى الخدمة، وقد يكون مجهول الهوية إذا كانت الخدمة مضبوطة على وصول عام، من استدعاء دوال قاعدة بيانات لا يُسمح بها. لم يُبلَّغ عن أي استغلال فعلي ولم تُدرَج الثغرة في CISA KEV. تتوفر تحديثات أمنية للإصدارات 12.1 و12.0 و11.5 و11.3 و11.1، ويُنصح من يستخدم إصدارات غير مدرجة (في حالة mature أو retired) بالترقية وتطبيق التحديث.

Affected products

Esri ArcGIS Server: from 11.1 before 12.1 — fixed in 12.1

How to fix

Upgrade to a fixed version: Esri ArcGIS Server 12.1. Check the vendor advisory for mitigations.

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/october-2026-arcgis-security-bulletin

Get alerted when CVE-2026-10757 or the next vulnerability affects your stack