AS
Product
ArcGIS Server
75
CVEs
0
On KEV
10.0
Max CVSS
6
New 30D
Severity mix
Critical 6High 7Medium 53Low 1
Watch
Add ArcGIS Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-57870 | 10.0 | Oct 22 | A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes Affected: 11.3 through 11.5 |
| CVE-2026-10757 New | 9.8 | Oct 26 | BUG-000187511 - ArcGIS Server has a security vulnerability. Affected: 11.1 before 12.1 |
| CVE-2026-9182 | 9.8 | Jul 6 | Unvalidated File Upload vulnerability in ArcGIS Server. Affected: through 12.0 |
| CVE-2021-29114 | 9.8 | Dec 7 | A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity… Affected: through 10.9.0 |
| CVE-2020-35712 | 9.8 | Dec 26 | Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations Affected: before 10.8 |
| CVE-2021-29102 | 9.1 | Jul 11 | A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to… Affected: before 10.9.0 |
| CVE-2024-51962 | 8.7 | Mar 3 | A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote… Affected: 10.9.1 through 11.3 |
| CVE-2024-51954 | 8.5 | Mar 3 | There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged… Affected: 10.9.1 through 11.3 |
| CVE-2022-38196 | 8.1 | Oct 25 | BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability Affected: All through 10.9.1 |
| CVE-2026-33521 New | 7.5 | Oct 26 | BUG-000186514 - ArcGIS Server has a security vulnerability. Affected: 11.1 before 12.0 |
| CVE-2026-9181 | 7.5 | Jul 6 | Directory Traversal in ArcGIS Server Affected: through 12.0 |
| CVE-2024-51961 | 7.5 | Mar 3 | There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose… Affected: 10.9.1 through 11.3 |
| CVE-2022-38202 | 7.5 | Dec 28 | There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below Affected: through 10.9.1 |
| CVE-2021-29095 | 6.8 | Mar 25 | Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized… Affected: through 10.8.1 |
| CVE-2021-29094 | 6.8 | Mar 25 | Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized… Affected: through 10.8.1 |
| CVE-2021-29093 | 6.8 | Mar 25 | A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to… Affected: through 10.8.1 |
| CVE-2026-50096 New | 6.1 | Oct 26 | BUG-000187164 - ArcGIS Server has a security vulnerability. Affected: 11.1 before 12.1 |
| CVE-2026-50095 New | 6.1 | Oct 26 | BUG-000187165 - ArcGIS Server has a security vulnerability. Affected: 11.1 before 12.1 |
| CVE-2026-33520 New | 6.1 | Oct 26 | BUG-000185167 - ArcGIS Server has a security vulnerability. Affected: 11.1 before 12.1 |
| CVE-2025-67711 | 6.1 | Dec 31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to… Affected: through 11.5 |
| CVE-2025-67710 | 6.1 | Dec 31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to… Affected: through 11.5 |
| CVE-2025-67709 | 6.1 | Dec 31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to… Affected: through 11.5 |
| CVE-2025-67708 | 6.1 | Dec 31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to… Affected: through 11.5 |
| CVE-2025-67705 | 6.1 | Dec 31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to… Affected: through 11.5 |
| CVE-2025-67704 | 6.1 | Dec 31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to… Affected: through 11.5 |
| CVE-2025-67703 | 6.1 | Dec 31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to… Affected: through 11.5 |
| CVE-2023-25841 | 6.1 | Jul 21 | There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker… Affected: 10.8.1 before 11.1 |
| CVE-2022-38195 | 6.1 | Oct 25 | BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server Affected: All through 10.9.1 |
| CVE-2022-38197 | 6.1 | Oct 25 | BUG-000148347 Unvalidated redirect issues in ArcGIS Server. Affected: All through 10.9.1 |
| CVE-2022-38198 | 6.1 | Oct 25 | BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server Affected: All through 10.9.1 |
| CVE-2022-38199 | 6.1 | Oct 25 | BUG-000144172 - Remote file download issue in ArcGIS Server Affected: All through 10.9.1 |
| CVE-2022-38200 | 6.1 | Oct 25 | BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server. Affected: All through 10.8.1 |
| CVE-2021-29116 | 6.1 | Dec 7 | A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated… Affected: 10.8.1; 10.9.0 |
| CVE-2021-29104 | 6.1 | Jul 11 | A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings… Affected: before 10.9.0 |
| CVE-2021-29103 | 6.1 | Jul 11 | A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which… Affected: before 10.9.0 |
| CVE-2021-29107 | 6.1 | Jul 10 | A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings… Affected: 10.6.1 |
| CVE-2021-29106 | 6.1 | Jul 10 | A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link… Affected: before 10.9.0 |
| CVE-2025-67707 | 5.6 | Dec 31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to… Affected: through 11.5 |
| CVE-2025-67706 | 5.6 | Dec 31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to… Affected: through 11.5 |
| CVE-2021-29105 | 5.4 | Jul 11 | A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store… Affected: before 10.9.0 |
| CVE-2026-33522 New | 5.3 | Oct 26 | BUG-000182936 - ArcGIS Server has a security vulnerability. Affected: 11.3 before 12.0 |
| CVE-2026-2812 | 5.3 | May 20 | Improper Authentication issue in ArcGIS Server Affected: 11.1 through 12.0 |
| CVE-2023-25848 | 5.3 | Aug 25 | ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a… Affected: 10.8.1 through 11.0 |
| CVE-2021-29099 | 5.3 | Jun 7 | A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier Affected: through 10.8.1 |
| CVE-2024-51966 | 4.9 | Mar 3 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below Affected: 10.9.1 through 11.3 |
| CVE-2024-51958 | 4.9 | Mar 3 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below Affected: 10.9.1 through 11.3 |
| CVE-2024-5888 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51963 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51960 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |
| CVE-2024-51959 | 4.8 | Mar 3 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link… Affected: 10.9.1 through 11.3 |