Esri vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-33521 There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted reqHigh 7.5 · Oct 26, 2026
• CVE-2026-10757 There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to Critical 9.8 · Oct 26, 2026
• CVE-2026-69227 A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions.Critical 9.8 · Oct 13, 2026
• CVE-2026-10758 Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type.High 7.5 · Sep 25, 2026
• CVE-2026-13020 A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes.High 8.1 · Jul 7, 2026
• CVE-2026-13019 Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remCritical 9.8 · Jul 7, 2026
• CVE-2026-9182 Esri ArcGIS Server contains an unrestricted file upload vulnerability.Critical 9.8 · Jul 6, 2026
• CVE-2026-9181 Esri ArcGIS Server contains a directory traversal vulnerability.Critical 9.8 · Jul 6, 2026
• CVE-2026-33519 An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permCritical 9.8 · Apr 21, 2026
• CVE-2026-33518 An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developCritical 9.8 · Apr 21, 2026
• CVE-2025-57870 A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes.Critical 10 · Oct 22, 2025
• CVE-2025-4967 Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.Critical 9.1 · May 29, 2025
• CVE-2025-2538 A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenCritical 9.8 · Mar 20, 2025
• CVE-2024-51962 A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed High 8.7 · Mar 3, 2025
• CVE-2024-51961 There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentHigh 7.5 · Mar 3, 2025
• CVE-2024-51954 There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote,High 8.5 · Mar 3, 2025
• CVE-2025-1068 There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the localHigh 7.3 · Feb 25, 2025
• CVE-2025-1067 There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file High 7.3 · Feb 25, 2025
• CVE-2024-38040 There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that couHigh 7.5 · Oct 4, 2024
• CVE-2024-25699 There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, aHigh 8.5 · Apr 4, 2024
• CVE-2024-25695 There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input tHigh 7.2 · Apr 4, 2024
• CVE-2024-25693 There is a path traversal in Esri Portal for ArcGIS versions <= 11.2.Critical 9.9 · Apr 4, 2024
• CVE-2023-25837 There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to cHigh 8.4 · Jul 21, 2023
• CVE-2023-25835 There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attackHigh 8.4 · Jul 20, 2023
• CVE-2023-25839 There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow a local, authorized attacker to executeHigh 7 · Jul 19, 2023