CVE-2026-33520 in ArcGIS Server
Summary
by MITRE • 10/26/2026
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for impacted ArcGIS Server software in General Availability and Extended support status, which includes versions 11.5. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
Esri Portal for ArcGIS versions 12.1 and prior contain a reflected cross-site scripting vulnerability that poses significant risks to users accessing the platform through web browsers. This security flaw allows remote, unauthenticated attackers to craft malicious links containing injected JavaScript payloads. When an unsuspecting victim clicks on such a link, the browser executes the arbitrary code within the context of the vulnerable application. Because the attack is reflected, the malicious script is typically embedded in the URL parameters or query strings and returned directly by the server without proper sanitization, leading to immediate execution upon page load. This mechanism enables attackers to bypass authentication requirements entirely, as no valid user session is needed to trigger the vulnerability, making it particularly dangerous for public-facing instances of ArcGIS Portal.
The operational impact of this vulnerability extends beyond simple script execution. An attacker can leverage the executed JavaScript to perform a variety of malicious actions against authenticated users who interact with the crafted link. These actions may include stealing sensitive session cookies or tokens, which could lead to account takeover and unauthorized access to geographic information system data. Additionally, attackers might redirect victims to phishing sites designed to harvest credentials or manipulate the user interface to display deceptive content that mimics legitimate Esri services. The ability to execute arbitrary code in the victim’s browser also opens avenues for keylogging, capturing sensitive input such as passwords or configuration details entered into the portal, thereby compromising the confidentiality and integrity of organizational data managed through ArcGIS platforms.
From a technical classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The reflected nature of the attack corresponds to techniques found in the MITRE ATT&CK framework under Injection and specifically reflects behaviors associated with Drive-by Code Execution or Phishing via Reflected URLs. Security professionals should recognize that while the vulnerability itself is a coding error involving insufficient output encoding, its exploitation relies on social engineering tactics to lure victims into clicking malicious links. This combination of technical flaw and human factor makes it critical for organizations to address both the code-level deficiency and user awareness regarding suspicious URL patterns.
Mitigation strategies must prioritize immediate remediation through software updates where applicable. Esri has provided patches for impacted ArcGIS Server software in General Availability and Extended support status, including versions 11.5. Organizations running these supported versions should apply the latest security patch immediately to neutralize the vulnerability. For users operating on older or mature versions that are no longer eligible for direct patching, upgrading to a currently supported release is strongly advised to ensure access to ongoing security fixes and feature enhancements. In addition to software updates, implementing web application firewalls can provide an additional layer of defense by filtering out malicious input patterns before they reach the application logic. Security teams should also enforce strict Content Security Policy headers to mitigate potential damage from any residual script execution risks while patching efforts are underway.