Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

ArcGIS Server may stop responding to users

CVE-2026-33521 · published 9 days ago
Summary

ArcGIS Server versions 12.0 and earlier can be overwhelmed by specially crafted requests, potentially causing the service to become unavailable. The problem does not require the attacker to be logged in. Apply the provided patch or upgrade to a supported version to keep the server running smoothly.

What to do
  • Update esri arcgis server to version 12.0 or later.
Affected software
VendorProductAffected versions
esri arcgis server < 12.0
Original advisory text
BUG-000186514 - ArcGIS Server has a security vulnerability.
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published26 Oct 2026
Updated4 Nov 2026
First seen26 Oct 2026
Sources
CVE-2026-33521 · NVD
CVE-2026-33521 · MITRE
Track software like this
Free during beta