CVE-2025-57870
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. A remote, unauthenticated attacker can execute arbitrary SQL commands via a specific ArcGIS Feature Service operation.
Risk Assessment
Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase, posing a serious threat to data integrity.
Recommendation
Update Esri ArcGIS Server to a patched version as soon as possible and review Feature Service access logs for suspicious SQL operations.
Other vulnerabilities in Esri ArcGIS Server
See all- CVE-2026-9182Critical
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks.
- CVE-2025-67711Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67710Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67709Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67708Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67705Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67704Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67703Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
Original NVD description (English source)
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS