CVE-2026-2813
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
ArcGIS Server has an input validation weakness in the login redirection workflow. An authenticated attacker can send a crafted request, causing the browser to redirect to an untrusted site, resulting in limited confidentiality impact under specific user interaction. The vulnerability affects ArcGIS Server 11.5.
Risk Assessment
An attacker could exploit this for phishing or credential theft by redirecting the user to a malicious site.
Recommendation
Apply appropriate patches from the vendor for ArcGIS Server 11.5.
Other vulnerabilities in ArcGIS Server
See all- CVE-2026-9181Critical
ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker can send crafted path parameters, allowing overwriting sensitive files on the system. Exploitation can lead to full administrative access to ArcGIS Server, with high impact on confidentiality, integrity, and availability.
- CVE-2026-2812Medium
ArcGIS Server has an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker can send a crafted request to this endpoint, potentially disrupting the web-based browsing interface. This affects ArcGIS Server 12.0 and earlier.
Original NVD description (English source)
ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions. The vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible. This issue affects ArcGIS Server 11.5.