CVE-2026-9181
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker can send crafted path parameters, allowing overwriting sensitive files on the system. Exploitation can lead to full administrative access to ArcGIS Server, with high impact on confidentiality, integrity, and availability.
Risk Assessment
The organization is at risk of an unauthenticated attacker gaining full control over ArcGIS Server, potentially leading to data loss, system integrity compromise, and service disruption.
Recommendation
Immediately upgrade ArcGIS Server to a version later than 12.0 on Windows and Linux. If an upgrade is not possible, restrict access to the server to trusted networks only.
Original NVD description (English source)
Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.