CVE-2026-2812: Improper Authentication issue in ArcGIS Server

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-20 · updated 2026-07-23
Weakness: CWE-287

Description

ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier.

Affected products

Esri ArcGIS Server: from 11.1 through 12.0

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

Get alerted when CVE-2026-2812 or the next vulnerability affects your stack