Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

ArcGIS Server can let attackers run unauthorized database commands

CVE-2026-10757 · published 1 day ago
Summary

ArcGIS Server versions up to 12.1 on Windows or Linux may let a user who can reach the service send specially crafted requests that execute database commands they shouldn’t. If the service is configured to allow public access, even an anonymous user could exploit this. Apply the latest patch from Esri or upgrade to a supported version as soon as possible.

What to do
  • Update esri arcgis server to version 12.1 or later.
Affected software
VendorProductAffected versions
esri arcgis server < 12.1
Original advisory text
BUG-000187511 - ArcGIS Server has a security vulnerability.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen26 Oct 2026
Sources
CVE-2026-10757 · NVD
CVE-2026-10757 · MITRE
Track software like this
Free during beta