CVE-2026-33522: BUG-000182936 - ArcGIS Server has a security vulnerability.
Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Affected Software
Event History
Frequently Asked Questions
Which ArcGIS Server deployments are affected?
ArcGIS Server versions 11.3 through 12.0 are affected. The issue permits remote, unauthenticated modification of service metadata.
Does an attacker need an account or user interaction to exploit this issue?
No. The vulnerability can be exploited remotely by an unauthenticated attacker, and no user interaction is required.
Which versions have an available patch?
Patches are available for General Availability and Extended support releases 12.0, 11.5, and 11.3. Versions in mature or retired status are not patch eligible.
What should organizations running an unlisted ArcGIS Server version do?
Upgrade to a supported version and apply the patch. The provided information states that unlisted versions are mature or retired and cannot receive patches.