Esri ArcGIS Server
64 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-50096 | 11.1 – < 12.1 | BUG-000187164 - ArcGIS Server has a security vulnerability. | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-50095 | 11.1 – < 12.1 | BUG-000187165 - ArcGIS Server has a security vulnerability. | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-33522 | 11.3 – < 12.0 | BUG-000182936 - ArcGIS Server has a security vulnerability. | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-33521 | 11.1 – < 12.0 | BUG-000186514 - ArcGIS Server has a security vulnerability. | HIGH 7.5 | 0.4 % | ||
| CVE-2026-33520 | 11.1 – < 12.1 | BUG-000185167 - ArcGIS Server has a security vulnerability. | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-10757 | 11.1 – < 12.1 | BUG-000187511 - ArcGIS Server has a security vulnerability. | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-9181 | ≤ 12.0 | Directory Traversal in ArcGIS Server | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-9182 | ≤ 12.0 | Unvalidated File Upload vulnerability in ArcGIS Server. | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-2813 | 11.5 | Unvalidated Redirect in ArcGIS Server | MEDIUM 4.7 | 0.3 % | ||
| CVE-2026-2812 | 11.1 – 12.0 | Improper Authentication issue in ArcGIS Server | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-67711 | 10.9.1 – 11.4 | Reflected XSS vulnerability in ArcGIS Server. | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-67710 | 10.9.1 – 11.4 | Stored XSS vulnerability in ArcGIS Server | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-67709 | 10.9.1 – 11.4 | There is a cross site scripting issue in ArcGIS Server. | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-67708 | 10.9.1 – 11.4 | Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server. | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-67707 | 10.9.1 – 11.5 | Unvalidated File Upload vulnerability in ArcGIS Server. | MEDIUM 5.6 | 0.3 % | ||
| CVE-2025-67706 | 10.9.1 – 11.4 | Unvalidated File Upload vulnerability in ArcGIS Server. | MEDIUM 5.6 | 0.4 % | ||
| CVE-2025-67705 | 10.9.1 – 11.4 | Reflected XSS vulnerability in ArcGIS Server. | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-67704 | 10.9.1 – 11.4 | Stored XSS vulnerability in ArcGIS Server. | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-67703 | 10.9.1 – 11.4 | Stored XSS vulnerability in ArcGIS Server. | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-57870 | 11.3 – 11.5 | BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services. | CRITICAL 10.0 | 0.5 % | ||
| CVE-2024-51966 | all – 11.3 | Directory traversal vulnerability in ArcGIS Server | MEDIUM 4.9 | 0.6 % | ||
| CVE-2024-51963 | all – 11.3 | Stored XSS in ArcGIS Server Manager | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51962 | all – 11.3 | SQL injection vulnerability in ArcGIS Server | HIGH 8.7 | 0.5 % | ||
| CVE-2024-51961 | all – 11.3 | Local file inclusion (LFI) vulnerability in ArcGIS Server | HIGH 7.5 | 0.5 % | ||
| CVE-2024-51960 | all – 11.3 | Stored XSS in ArcGIS Server Administrator Directory | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51959 | all – 11.3 | Stored XSS issue in Server Admin API | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51958 | all – 11.3 | Directory traversal vulnerability in the admin api for service thumbnails | MEDIUM 4.9 | 0.6 % | ||
| CVE-2024-51957 | all – 11.3 | Stored XSS vulnerability in ArcGIS Rest Services Directory | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51956 | all – 11.3 | Stored XSS vulnerability in ArcGIS Server Administrator Directory | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51954 | all – 11.3 | Unauthorized access to secure services in ArcGIS Server | HIGH 8.5 | 0.3 % | ||
| CVE-2024-51953 | all – 11.3 | Stored XSS in ArcGIS Server Rest services | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51952 | all – 11.3 | Stored XSS issue in ArcGIS Server | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51951 | all – 11.3 | Stored XSS in Server Admin API | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51950 | all – 11.3 | Stored XSS in Server Admin under Services > lifecycleinfos | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51949 | all – 11.3 | Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51948 | all – 11.3 | Stored XSS vulnerability in Rest Services under Job ID | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51947 | all – 11.3 | Stored XSS vulnerability in Rest Services under Layer name | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51946 | all – 11.3 | Stored XSS in Rest Services Directory under Identify operation | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51945 | all – 11.3 | Stored XSS issues in Server Admin API | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51944 | all – 11.3 | Stored XSS in Rest Services Directory | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-51942 | all – 11.3 | Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-10904 | all – 11.3 | Stored XSS in Server Admin API | MEDIUM 4.8 | 0.3 % | ||
| CVE-2024-5888 | all – 11.3 | Stored XSS in Rest Services API for a Toolbox published as GP Service | MEDIUM 4.8 | 0.3 % | ||
| CVE-2022-38202 | 11.0 – all | BUG-000152121 - Directory traversal vulnerability in ArcGIS Server. | HIGH 7.5 | 1.4 % | ||
| CVE-2022-38195 | All – 10.9.1 | BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server | MEDIUM 6.1 | 0.5 % | ||
| CVE-2022-38196 | All – 10.9.1 | BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability | HIGH 8.1 | 1.2 % | ||
| CVE-2022-38197 | All – 10.9.1 | BUG-000148347 Unvalidated redirect issues in ArcGIS Server. | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-38198 | All – 10.9.1 | BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-38199 | All – 10.9.1 | BUG-000144172 - Remote file download issue in ArcGIS Server | MEDIUM 6.1 | 0.3 % | ||
| CVE-2022-38200 | All – 10.8.1 | BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server. | MEDIUM 6.1 | 0.4 % | ||
| CVE-2021-29116 | 10.8.1 – < 10.9.0 | BUG-000142180 Hosted feature services vulnerable to stored XSS | MEDIUM 6.1 | 0.8 % | ||
| CVE-2021-29115 | All – 10.9.0 | An information disclosure vulnerability | MEDIUM 5.3 | 2.2 % | ||
| CVE-2021-29114 | All – < 10.9.0 | SQL injection vulnerability in ArcGIS Server | CRITICAL 9.8 | 1.0 % | ||
| CVE-2021-29113 | 10.9 – 10.9.0 | Remote file inclusion vulnerability in ArcGIS Server help documentation | MEDIUM 4.7 | 0.8 % | ||
| CVE-2021-29104 | All – < 10.9.0 | There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below. | MEDIUM 6.1 | 0.8 % | ||
| CVE-2021-29102 | All – < 10.9.0 | There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below. | CRITICAL 9.1 | 1.6 % | ||
| CVE-2021-29103 | All – < 10.9 | There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below. | MEDIUM 6.1 | 0.7 % | ||
| CVE-2021-29105 | All – < 10.9.0 | There is a stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below. | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-29106 | All – < 10.9.0 | There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below. | MEDIUM 6.1 | 0.7 % | ||
| CVE-2021-29107 | 10.6.1 | There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below. | MEDIUM 6.1 | 0.9 % | ||
| CVE-2021-29099 | 10.8.1 – < 10.9.0 | There is a SQL injection vulnerability in ArcGIS Server | MEDIUM 5.3 | 0.6 % | ||
| CVE-2021-29095 | 10.8.1 – < 10.9 | ArcGIS Server image service and raster analytics security update: uninitialized pointer | MEDIUM 6.8 | 0.9 % | ||
| CVE-2021-29094 | All – 10.9.0 | ArcGIS Server image service and raster analytics security update: buffer overflow | MEDIUM 6.8 | 1.0 % | ||
| CVE-2021-29093 | All – 10.9 | ArcGIS Server image service and raster analytics security update: use-after-free | MEDIUM 6.8 | 1.0 % |