CVE-2026-9182
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks.
Risk Assessment
The risk for the organization includes the possibility of remote code execution or server takeover by an unauthenticated attacker, potentially leading to data confidentiality and integrity breaches.
Recommendation
It is recommended to immediately upgrade Esri ArcGIS Server to a version later than 12.0 or apply the relevant security patches provided by the vendor.
Original NVD description (English source)
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.