CVE-2026-9182

Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-25)

CWE

CWE-434

Published

2026-07-06

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• esri:arcgis_server

References

• https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/may-2026-arcgis-security-bulletin

Check your stackJSON