Esri vulnerabilities
We track 37 vulnerabilities in Esri products across 8 products. 37 are rated high or critical, and none are known to be exploited. The most recent was published on October 26, 2026.
Latest Esri vulnerabilities
- 7.5 High severity
ArcGIS Server: Uncontrolled Resource Consumption
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny servi
- 9.8 Critical severity
ArcGIS Server: Improper Neutralization of Special Elements used in an SQL Command
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access c
- 9.8 Critical severity
Portal for ArcGIS: Missing Authentication for Critical Functionality
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
- 7.5 High severity
Lerc: Integer Overflow or Wraparound
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass
- 7.5 High severity
Portal for ArcGIS: Exposure of Sensitive Information to an Unauthorized Actor
There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.
- 7.5 High severity
Portal for ArcGIS: Exposure of Sensitive Information to an Unauthorized Actor
There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.
- 9.8 Critical severity
Portal for ArcGIS: Weak Password Recovery Mechanism for Forgotten Password
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcG
- 9.8 Critical severity
Portal for ArcGIS: Weak Password Recovery Mechanism for Forgotten Password
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be a
- 9.8 Critical severity
ArcGIS Server: Unrestricted Upload of File with Dangerous Type
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing fo
- 7.5 High severity
ArcGIS Server: Improper Limitation of a Pathname to a Restricted Directory
Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive
- 9.8 Critical severity
Portal for ArcGIS: Incorrect Privilege Assignment
An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.
- 7.2 High severity
Portal for ArcGIS: Incorrect Privilege Assignment
An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.
- 10.0 Critical severity
ArcGIS Server: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service opera
- 9.8 Critical severity
Portal for ArcGIS: Use of Hard-coded Credentials
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.
- 8.7 High severity
ArcGIS Server: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is re
- 7.5 High severity
ArcGIS Server: Externally Controlled Reference to a Resource in Another Sphere
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.
- 8.5 High severity
ArcGIS Server: Improper Access Control
There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfedera
- 7.3 High severity
ArcGIS AllSource: Untrusted Search Path
There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a speci
- 7.3 High severity
ArcGIS Pro: Incorrect Permission Assignment for Critical Resource
There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific ac
- 7.5 High severity
Portal for ArcGIS: External Control of File Name or Path
There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.
- 8.5 High severity
Portal for ArcGIS: Improper Authentication
There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could a
- 7.2 High severity
Portal for ArcGIS: Improper Neutralization of Input During Web Page Generation
There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to e
- 9.9 Critical severity
Portal for ArcGIS: Improper Limitation of a Pathname to a Restricted Directory
There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory.
- 8.4 High severity
Portal for ArcGIS Sites: Improper Neutralization of Input During Web Page Generation
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary Jav
- 8.4 High severity
Portal for ArcGIS Sites: Improper Neutralization of Input During Web Page Generation
There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configurat
- 7.0 High severity
ArcGIS Insights: Improper Neutralization of Special Elements used in an SQL Command
There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow a local, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted inp
- 7.5 High severity
ArcGIS Insights: Improper Neutralization of Special Elements used in an SQL Command
There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input requir
- 8.8 High severity
Portal for ArcGIS: Cross-Site Request Forgery
There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user into executing unwanted actions.
- 7.5 High severity
ArcGIS Enterprise: Server-Side Request Forgery
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, po
- 7.5 High severity
ArcGIS Enterprise: Server-Side Request Forgery
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, po
- 7.5 High severity
ArcGIS Enterprise: Improper Limitation of a Pathname to a Restricted Directory
In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the file system and lead to the disclosure of sensitive data (not customer-published con
- 7.5 High severity
Portal for ArcGIS: Server-Side Request Forgery
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, po
- 7.5 High severity
ArcGIS Server: Improper Limitation of a Pathname to a Restricted Directory
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This coul
- 8.1 High severity
ArcGIS Server: Improper Limitation of a Pathname to a Restricted Directory
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
- 7.5 High severity
Portal for ArcGIS: Improper Access Control
There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.
- 9.6 Critical severity
Portal for ArcGIS: Improper Control of Generation of Code
There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution.
- 7.5 High severity
Portal for ArcGIS: Server-Side Request Forgery
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.