CVE-2026-9182
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks.
Risk Assessment
The risk for the organization includes the possibility of remote code execution or server takeover by an unauthenticated attacker, potentially leading to data confidentiality and integrity breaches.
Recommendation
It is recommended to immediately upgrade Esri ArcGIS Server to a version later than 12.0 or apply the relevant security patches provided by the vendor.
Other vulnerabilities in Esri ArcGIS Server
See all- CVE-2025-57870Critical
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. A remote, unauthenticated attacker can execute arbitrary SQL commands via a specific ArcGIS Feature Service operation.
- CVE-2025-67711Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67710Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67709Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67708Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67705Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67704Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
- CVE-2025-67703Medium
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.
Original NVD description (English source)
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS