ESRI ArcGIS Server 10.9.1/11.1/11.2/11.3 on Windows access control

Summaryinfo

A vulnerability identified as critical has been detected in ESRI ArcGIS Server 10.9.1/11.1/11.2/11.3 on Windows. This vulnerability affects unknown code. The manipulation leads to access control. This vulnerability is listed as CVE-2024-51954. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in ESRI ArcGIS Server 10.9.1/11.1/11.2/11.3 on Windows. This issue affects some unknown functionality. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfederated) ArcGIS Server instance. Successful exploitation results in unauthorized access to protected services outside the attacker’s originally assigned authorization boundary, constituting a scope change. If exploited, this issue would have a high impact on confidentiality, a low impact on integrity, and no impact on the availability of the software.

The advisory is shared at esri.com. The identification of this vulnerability is CVE-2024-51954 since 11/04/2024. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/20/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 299400 (ArcGIS Server < 11.3 Multiple Vulnerabilities (2025 Update 1)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (299400). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• ESRI

Name

• ArcGIS Server

Version

• 10.9.1
• 11.1
• 11.2
• 11.3

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion