There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 8
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-27 03:55
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-27 04:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 19:38
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 20:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 18:05
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 18:31
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 18:05
- First seenCVSS 9.8NVD modified 2026-10-26 18:31
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.