CVE-2025-2538

BUG-000174336

A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57870

BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Esri Kubernetes Linux and 1 more

Products

Arcgis Server Kubernetes Linux and 2 more

CVE-2025-67707

Unvalidated File Upload vulnerability in ArcGIS Server.

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data. Because the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2025-67706

Unvalidated File Upload vulnerability in ArcGIS Server.

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data. Because the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2024-51962

SQL injection vulnerability in ArcGIS Server

A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced application‑specific permissions, indicating high privileges are required. Successful exploitation would have a high impact on integrity and confidentiality, with no impact on availability.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-25709

Self-XSS style in move item dialog

There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScript code in a victim’s browser. Exploitation does not require any privileges and can be performed by an anonymous user.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Portal For Arcgis Linux Kernel Windows

CVE-2024-25705

Cross site scripting issue in embed widget

There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation requires basic authenticated access but does not require elevated or administrative privileges, indicating low privileges are required.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Portal For Arcgis Linux Kernel Windows

CVE-2024-51954

Unauthorized access to secure services in ArcGIS Server

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfederated) ArcGIS Server instance. Successful exploitation results in unauthorized access to protected services outside the attacker’s originally assigned authorization boundary, constituting a scope change. If exploited, this issue would have a high impact on confidentiality, a low impact on integrity, and no impact on the availability of the software.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Kernel Windows

CVE-2024-25699

Portal for ArcGIS has an invalid authentication vulnerability

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker with low‑privileged access to compromise the confidentiality, integrity, and availability of the software. Successful exploitation allows the attacker to cross an authentication and authorization boundary beyond their originally assigned access, resulting in a scope change.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Enterprise Portal For Arcgis Linux Kernel and 1 more

CVE-2024-8149

BUG-000168624 - Unvalidated redirect in Portal for ArcGIS.

There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation is limited to the same browser execution context and does not result in a change of security scope beyond the affected user session.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2023-25837

BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.

There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2023-25835

BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability

There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configuration. When accessed by a victim, the stored payload may execute arbitrary JavaScript code in the victim’s browser. Successful exploitation could allow the attacker to access sensitive user data and session information, alter trusted site content and user actions, and disrupt normal site functionality, resulting in a high impact to confidentiality, integrity, and availability.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-67703

Stored XSS vulnerability in ArcGIS Server.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2025-67704

Stored XSS vulnerability in ArcGIS Server.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2025-67705

Reflected XSS vulnerability in ArcGIS Server.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2025-67708

Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2025-67709

There is a cross site scripting issue in ArcGIS Server.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2025-67710

Stored XSS vulnerability in ArcGIS Server

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2025-67711

Reflected XSS vulnerability in ArcGIS Server.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Server Linux Linux Kernel and 1 more

CVE-2025-4967

Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS

Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis