CVE-2026-33522 in ArcGIS Server
Summary
by MITRE • 10/26/2026
Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified affects Esri ArcGIS Server software within specific version ranges, namely from 11.3 through 12.0 inclusive. This security flaw represents a critical failure in access control mechanisms that governs how service metadata is modified on the server infrastructure. The core technical deficiency lies in the authentication logic applied to administrative endpoints responsible for updating service properties. Specifically, the system fails to enforce strict identity verification before permitting modifications to sensitive configuration data associated with published geographic information services. This architectural oversight allows any remote actor who can reach the network interface hosting ArcGIS Server to interact with these metadata update functions without providing valid credentials or session tokens. The absence of proper authorization checks means that the server treats unauthenticated requests as legitimate administrative actions, thereby bypassing fundamental security boundaries designed to protect system integrity and configuration consistency.
From an operational perspective, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of geographic information systems managed by affected organizations. An attacker leveraging this flaw can alter service metadata without detection or restriction. Such modifications may include changing connection strings, altering endpoint URLs, modifying description fields that could be used for social engineering attacks against end-users, or disabling security features associated with specific services. In a production environment where ArcGIS Server serves as the backbone for critical spatial data distribution and analysis, unauthorized changes to service metadata can lead to significant disruption of business operations. It may result in clients receiving incorrect geographic data, being redirected to malicious endpoints, or experiencing complete service outages if essential configurations are corrupted. Furthermore, because the attack requires no authentication, it is easily exploitable by automated tools, increasing the likelihood of widespread compromise across networks that expose ArcGIS Server interfaces to untrusted zones such as the internet.
This vulnerability aligns with common classification standards in cybersecurity frameworks. It corresponds closely to CWE-287, which describes Improper Authentication, where an actor is able to bypass authentication mechanisms to gain access to resources or perform actions they are not authorized for. Additionally, it relates to CWE-693, Protection Mechanism Failure, as the system fails to protect against unauthorized modification of critical configuration data. In terms of tactical mapping within the MITRE ATT&CK framework, this flaw facilitates initial access and potential privilege escalation depending on the context of subsequent actions taken by the attacker. The ability to modify service metadata can be categorized under techniques related to Defense Evasion or Impact, as attackers may use these changes to maintain persistence, disrupt services, or hide their presence within the environment.
To mitigate this risk, organizations running Esri ArcGIS Server versions 11.3 through 12.0 must apply the official patch provided by Esri immediately. The vendor has released updates for software in General Availability and Extended support status, specifically covering versions 12.0, 11.5, and 11.3. It is imperative to verify that the deployed instance falls within these supported version ranges before applying patches. For environments utilizing older or mature versions of ArcGIS Server that are no longer eligible for patching through standard updates, upgrading to a currently supported release is strongly advised. This upgrade path ensures access to ongoing security fixes and support from Esri. In addition to software remediation, network-level controls should be reviewed to ensure that administrative interfaces are not unnecessarily exposed to untrusted networks. Implementing strict firewall rules, using reverse proxies with authentication gateways, and enforcing multi-factor authentication for all administrative access can provide defense-in-depth measures while the patch is being deployed. Regular vulnerability scanning and monitoring of system logs for unauthorized metadata changes should also be implemented to detect any potential exploitation attempts in real-time.