CVE-2026-2812
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
ArcGIS Server has an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker can send a crafted request to this endpoint, potentially disrupting the web-based browsing interface. This affects ArcGIS Server 12.0 and earlier.
Risk Assessment
The risk is that an unauthenticated attacker could disrupt the web interface, impacting the availability of GIS services.
Recommendation
Immediately update ArcGIS Server to the latest available version and restrict access to undocumented endpoints.
Other vulnerabilities in ArcGIS Server
See all- CVE-2026-9181Critical
ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker can send crafted path parameters, allowing overwriting sensitive files on the system. Exploitation can lead to full administrative access to ArcGIS Server, with high impact on confidentiality, integrity, and availability.
- CVE-2026-2813Medium
ArcGIS Server has an input validation weakness in the login redirection workflow. An authenticated attacker can send a crafted request, causing the browser to redirect to an untrusted site, resulting in limited confidentiality impact under specific user interaction. The vulnerability affects ArcGIS Server 11.5.
Original NVD description (English source)
ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier.