CVE-2026-50095: BUG-000187165 - ArcGIS Server has a security vulnerability.
There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Affected Software
Event History
Frequently Asked Questions
Which ArcGIS Server deployments are exposed?
ArcGIS Server 11.1 and earlier on Windows and Linux are affected in some configurations. The issue is not described as affecting every configuration.
What does exploitation require?
A remote attacker does not need authentication, but must be able to store a file containing malicious code. The malicious code may then execute when a victim views it in their browser.
Which versions can receive a patch?
Patches are available for ArcGIS Server versions 12.1, 12.0, 11.5, 11.3, and 11.1 that are in General Availability or Extended support. Versions in mature or retired status are not patch eligible.
What should organizations using an unlisted or unsupported version do?
Upgrade to a supported version and apply the patch. The provided information advises this for users of versions not listed as patch eligible.