Esri
Vulnerability activity for Esri: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- –UnscoredOct 27, 2026EsriADV-cccs-80a0d83a1a92Serial number: AV26-1088 Date: October 27, 2026 As of October 26, 2026, Esri is affected by vulnerabilities in the following product: ArcGIS Server Prior to 12.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. October 2026 ArcGIS Security Bulletin Esri Security Advisories
- 9.8CriticalOct 26, 2026Esri ArcGIS Server SQL injectionCVE-2026-10757There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versio
- –UnscoredOct 13, 2026EsriADV-cccs-c7824c8b0a00Serial number: AV26-1036 Date: October 13, 2026 As of October 13, 2026, Esri is affected by vulnerabilities in the following product: Portal for ArcGIS Prior to 12.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. September 2026 ArcGIS Security Bulletin Esri Security Advisories
- 5.5MediumOct 13, 2026Esri Portal for ArcGISCVE-2026-10759A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.
- 9.8CriticalJul 6, 2026Esri arcgis server Path traversal / file handlingCVE-2026-9182Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.
- 9.8CriticalJul 6, 2026Esri arcgis server Path traversal / file handlingCVE-2026-9181Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 an1.2% likelyDetection
Top products
- ArcGIS Server3 CVEs in the last year, 3 critical
- Portal for ArcGIS1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 27, 2026Esri security advisory (AV26-1088)ADV-cccs-80a0d83a1a92
- CCCS (Canada) · Oct 13, 2026Esri security advisory (AV26-1036)ADV-cccs-c7824c8b0a00
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.