What is CVE-2026-9181?

CVE-2026-9181 is a critical-severity vulnerability in Esri Arcgis Server, classified under Path Traversal. CVSS score: 9.8/10. Published 2026-07-06.

How severe is CVE-2026-9181?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Path Traversal in Esri Arcgis Server

CVE-2026-9181

Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.009 (58.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-22 — Path Traversal

References

psirt@esri.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-9181?: CVE-2026-9181 is a critical-severity vulnerability in Esri Arcgis Server, classified under Path Traversal. CVSS score: 9.8/10. Published 2026-07-06.
How severe is CVE-2026-9181?: Critical severity. CVSS v3 base score is 9.8 out of 10.