CVE-2026-10757

There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser. A patch is provided for versions 12.1, 12.0, 11.5, 11.3, and 11.1.

Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for versions 12.0, 11.5, and 11.3.

There is a denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users.

Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks.

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. A remote, unauthenticated attacker can execute arbitrary SQL commands via a specific ArcGIS Feature Service operation.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.