Esri
172 CVEs across 41 Esri products. Browse Esri vulnerabilities, severities, and proof-of-concept exploits.
Esri products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13020 | High | 8.1 | 2026-07-07 | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote… |
CVE-2026-13019 | Critical | 9.8 | 2026-07-07 | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a re… |
CVE-2026-9182 | Critical | 9.8 | 2026-07-06 | Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the… |
CVE-2026-9181 | Critical | 9.8 | 2026-07-06 | Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit thi… |
CVE-2026-2813 | Medium | 4.7 | 2026-05-20 | ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a speciall… |
CVE-2026-2812 | Medium | 5.3 | 2026-05-20 | ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issu… |
CVE-2026-33519 | Critical | 9.8 | 2026-04-21 | An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check per… |
CVE-2026-33518 | Critical | 9.8 | 2026-04-21 | An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create develo… |
CVE-2026-1446 | Medium | 5.0 | 2026-01-26 | There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to… |
CVE-2025-67711 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67710 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67709 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67708 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67707 | Medium | 5.6 | 2025-12-31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload… |
CVE-2025-67706 | Medium | 5.6 | 2025-12-31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload… |
CVE-2025-67705 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67704 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67703 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67712 | Medium | 4.7 | 2025-12-19 | There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to poten… |
CVE-2025-57870 | Critical | 10.0 | 2025-10-22 | A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, u… |
CVE-2025-57879 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-57878 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-57877 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57876 | Medium | 4.8 | 2025-09-29 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malic… |
CVE-2025-57875 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57874 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57873 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57872 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-57871 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-55107 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticat… |
CVE-2025-55106 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-55105 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-55104 | Medium | 4.8 | 2025-08-21 | A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create o… |
CVE-2025-55103 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-4967 | Critical | 9.1 | 2025-05-29 | Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections. |
CVE-2025-2538 | Critical | 9.8 | 2025-03-20 | A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthe… |
CVE-2024-5888 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51966 | Medium | 4.9 | 2025-03-03 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with… |
CVE-2024-51963 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a… |
CVE-2024-51962 | High | 8.7 | 2025-03-03 | A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed… |
CVE-2024-51961 | High | 7.5 | 2025-03-03 | There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could poten… |
CVE-2024-51960 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51959 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51958 | Medium | 4.9 | 2025-03-03 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with… |
CVE-2024-51957 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51956 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51954 | High | 8.5 | 2025-03-03 | There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote… |
CVE-2024-51953 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51952 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51951 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51950 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51949 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51948 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51947 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51946 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51945 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51944 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51942 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-10904 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2025-1726 | Medium | 4.3 | 2025-02-26 | There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low… |
CVE-2025-1068 | High | 7.3 | 2025-02-25 | There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the loca… |
CVE-2025-1067 | High | 7.3 | 2025-02-25 | There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file… |
CVE-2024-8149 | Medium | 4.6 | 2024-10-04 | There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker… |
CVE-2024-8148 | Medium | 6.1 | 2024-10-04 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2024-38040 | High | 7.5 | 2024-10-04 | There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that co… |
CVE-2024-38039 | Medium | 5.4 | 2024-10-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted… |
CVE-2024-38038 | Medium | 6.1 | 2024-10-04 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 which may allow a remote, unauthenticated attacker to create a crafted link whic… |
CVE-2024-38037 | Medium | 6.1 | 2024-10-04 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2024-38036 | Medium | 5.4 | 2024-10-04 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a craft… |
CVE-2024-25707 | Medium | 4.8 | 2024-10-04 | There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with adminis… |
CVE-2024-25702 | Medium | 4.8 | 2024-10-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated… |
CVE-2024-25701 | Medium | 4.8 | 2024-10-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, a… |
CVE-2024-25694 | Medium | 4.8 | 2024-10-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 11.1 and below that may allow a remote, authenticated attack… |
CVE-2024-25691 | Medium | 6.1 | 2024-10-04 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 and below which may allow a remote, unauthenticated attacker to create a crafted… |
CVE-2024-25709 | Medium | 6.1 | 2024-04-04 | There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to… |
CVE-2024-25708 | Medium | 4.8 | 2024-04-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, au… |
CVE-2024-25706 | Medium | 6.1 | 2024-04-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when… |
CVE-2024-25705 | Medium | 5.4 | 2024-04-04 | There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a rem… |
CVE-2024-25700 | Medium | 4.8 | 2024-04-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 11.1 and below that may allow a remote, auth… |
CVE-2024-25699 | High | 8.5 | 2024-04-04 | There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux… |
CVE-2024-25698 | Medium | 6.1 | 2024-04-04 | There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a rem… |
CVE-2024-25697 | Medium | 5.4 | 2024-04-04 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a craft… |
CVE-2024-25696 | Medium | 4.8 | 2024-04-04 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a craft… |
CVE-2024-25695 | High | 7.2 | 2024-04-04 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input… |
CVE-2024-25693 | Critical | 9.9 | 2024-04-04 | There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file… |
CVE-2024-25692 | Medium | 5.4 | 2024-04-04 | There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated at… |
CVE-2024-25690 | Medium | 4.7 | 2024-04-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafte… |
CVE-2023-25848 | Medium | 5.3 | 2023-08-25 | ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query… |
CVE-2023-25841 | Medium | 6.1 | 2023-07-21 | There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unau… |
CVE-2023-25840 | Low | 3.4 | 2023-07-21 | There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted l… |
CVE-2023-25837 | High | 8.4 | 2023-07-21 | There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to… |
CVE-2023-25836 | Medium | 5.4 | 2023-07-21 | There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to cre… |
CVE-2023-25835 | High | 8.4 | 2023-07-21 | There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attac… |
CVE-2023-25839 | High | 7.0 | 2023-07-19 | There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow a local, authorized attacker to execut… |
CVE-2023-25838 | High | 7.5 | 2023-07-19 | There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrar… |
CVE-2023-25833 | Medium | 5.4 | 2023-05-10 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted… |
CVE-2023-25832 | High | 8.8 | 2023-05-09 | There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user in… |
CVE-2023-25831 | Medium | 6.1 | 2023-05-09 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafte… |
CVE-2023-25830 | Medium | 6.1 | 2023-05-09 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a craft… |
CVE-2023-25829 | Medium | 6.1 | 2023-05-09 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |