Description
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Esri | ArcGIS Server | 11.3 – ≤ 11.5 | — |
Advisories 1
- WID-SEC-2025-2228 ESRI ArcGIS: Schwachstelle ermöglicht SQL injection BSI CERT-Bund (WID) · Oct 22, 2025