Skip to content
OpenAdvisories
High WID-SEC-2026-3965 6 CVEs

ESRI ArcGIS: Mehrere Schwachstelle

Published Oct 14, 2026 · Updated Oct 26, 2026 · Revision 2 · de-DE

Vendor: Esri Product: ArcGIS Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um einen SQL-Injection oder Cross Site Scripting Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und einen Denial of Service zu verursachen.

Product

ArcGIS ist ein Geoinformationssystem.

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-10757

    BUG-000187511 - ArcGIS Server has a security vulnerability.

    There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access …

    Esri ArcGIS Server
  • High 7.5
    CVE-2026-33521

    BUG-000186514 - ArcGIS Server has a security vulnerability.

    There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny serv…

    Esri ArcGIS Server
  • Medium 6.1
    CVE-2026-33520

    BUG-000185167 - ArcGIS Server has a security vulnerability.

    There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the…

    Esri ArcGIS Server
  • Medium 6.1
    CVE-2026-50095

    BUG-000187165 - ArcGIS Server has a security vulnerability.

    There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victi…

    Esri ArcGIS Server
  • Medium 6.1
    CVE-2026-50096

    BUG-000187164 - ArcGIS Server has a security vulnerability.

    There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the…

    Esri ArcGIS Server
  • Medium 5.3
    CVE-2026-33522

    BUG-000182936 - ArcGIS Server has a security vulnerability.

    Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.…

    Esri ArcGIS Server

Revision history

  1. #2

    Referenzen ergänzt

  2. #1

    Initiale Fassung

References