CVE-2021-29093

6.8 mediumEPSS 1.0%

Medium (6.8) in esri arcgis server. EPSS 1.0% chance of exploitation in the next 30 days.

A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-416
Published: 2021-03-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

esri:arcgis_server

References

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image
https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image

Check your stack JSON