CVE-2026-33521 in ArcGIS Server
Summary
by MITRE • 10/26/2026
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability represents a significant denial of service risk within Esri ArcGIS Server software, specifically affecting versions 12.0 and earlier releases that remain under General Availability or Extended support status. This flaw allows for remote exploitation by an unauthenticated attacker who can craft specific malicious requests designed to trigger excessive resource consumption on the server side. The core technical mechanism involves the exhaustion of available worker threads within the application's processing architecture. When these threads are consumed, the system becomes unable to handle legitimate user requests, effectively resulting in a service outage for all connected users attempting to access geographic information services or spatial data operations hosted by the compromised instance.
From a technical perspective, this vulnerability aligns with CWE-400, which describes conditions where resources such as memory, CPU time, or thread counts are not properly constrained during processing. In the context of ArcGIS Server, the handling of incoming requests likely lacks sufficient validation or rate limiting mechanisms for certain endpoints or parameters. This oversight permits an attacker to send a high volume of specially crafted packets that force the server to allocate worker threads without releasing them promptly or efficiently. Under exceptional circumstances, such as when the attack traffic is sustained or particularly complex in its processing requirements, this leads to thread pool exhaustion. The operational impact is severe, as it results in a complete denial of service for legitimate users who rely on the platform for critical spatial analysis and mapping functionalities.
The exploitation vector is remote and unauthenticated, which significantly lowers the barrier to entry for potential attackers. This characteristic places the vulnerability within the ATT&CK framework under techniques related to Resource Hijacking or Denial of Service, specifically those that target service availability rather than data confidentiality or integrity. The ability to disrupt services without prior authentication makes this a high-severity issue for organizations relying on ArcGIS Server for public-facing applications or internal operational continuity. Attackers can leverage automated tools to generate the necessary crafted requests, potentially causing prolonged downtime and impacting business operations dependent on real-time geospatial data access.
Mitigation strategies must prioritize immediate patching for all eligible systems. Esri has provided patches for versions 12.0, 11.5, 11.3, and 11.1, which are currently in General Availability or Extended support status. Administrators should verify their current software version against this list and apply the latest security updates immediately to close the thread exhaustion gap. For organizations running versions that have reached mature or retired status, patching is not directly available through standard update channels due to end-of-life policies. In these cases, upgrading to a supported release line is strongly advised as part of the remediation process. Additionally, implementing network-level controls such as rate limiting, Web Application Firewall rules targeting suspicious request patterns, and strict access control lists can provide compensating controls to mitigate the risk while patching efforts are underway. Regular monitoring for unusual spikes in thread usage or connection counts should also be established to detect potential exploitation attempts early.