AS
Product
ArcGIS Server
75
CVEs
0
On KEV
10.0
Max CVSS
6
New 30D
Severity mix
Critical 6High 7Medium 53Low 1
Watch
Add ArcGIS Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-29095 | 6.8 | Mar 25 | Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized… Affected: through 10.8.1 |
| CVE-2021-29094 | 6.8 | Mar 25 | Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized… Affected: through 10.8.1 |
| CVE-2021-29093 | 6.8 | Mar 25 | A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to… Affected: through 10.8.1 |
| CVE-2026-50096 New | 6.1 | Oct 26 | BUG-000187164 - ArcGIS Server has a security vulnerability. Affected: 11.1 before 12.1 |
| CVE-2026-50095 New | 6.1 | Oct 26 | BUG-000187165 - ArcGIS Server has a security vulnerability. Affected: 11.1 before 12.1 |
| CVE-2026-33520 New | 6.1 | Oct 26 | BUG-000185167 - ArcGIS Server has a security vulnerability. Affected: 11.1 before 12.1 |
| CVE-2025-67711 | 6.1 | Dec 31 | Reflected XSS vulnerability in ArcGIS Server. Affected: 10.9.1 through 11.4 |
| CVE-2025-67710 | 6.1 | Dec 31 | Stored XSS vulnerability in ArcGIS Server Affected: 10.9.1 through 11.4 |
| CVE-2025-67709 | 6.1 | Dec 31 | There is a cross site scripting issue in ArcGIS Server. Affected: 10.9.1 through 11.4 |
| CVE-2025-67708 | 6.1 | Dec 31 | Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server. Affected: 10.9.1 through 11.4 |
| CVE-2025-67705 | 6.1 | Dec 31 | Reflected XSS vulnerability in ArcGIS Server. Affected: 10.9.1 through 11.4 |
| CVE-2025-67704 | 6.1 | Dec 31 | Stored XSS vulnerability in ArcGIS Server. Affected: 10.9.1 through 11.4 |
| CVE-2025-67703 | 6.1 | Dec 31 | Stored XSS vulnerability in ArcGIS Server. Affected: 10.9.1 through 11.4 |
| CVE-2023-25841 | 6.1 | Jul 21 | There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker… Affected: 10.8.1 before 11.1 |
| CVE-2022-38195 | 6.1 | Oct 25 | BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server Affected: All through 10.9.1 |
| CVE-2022-38197 | 6.1 | Oct 25 | BUG-000148347 Unvalidated redirect issues in ArcGIS Server. Affected: All through 10.9.1 |
| CVE-2022-38198 | 6.1 | Oct 25 | BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server Affected: All through 10.9.1 |
| CVE-2022-38199 | 6.1 | Oct 25 | BUG-000144172 - Remote file download issue in ArcGIS Server Affected: All through 10.9.1 |
| CVE-2022-38200 | 6.1 | Oct 25 | BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server. Affected: All through 10.8.1 |
| CVE-2021-29116 | 6.1 | Dec 7 | A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated… Affected: 10.8.1; 10.9.0 |
| CVE-2021-29104 | 6.1 | Jul 11 | A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings… Affected: before 10.9.0 |
| CVE-2021-29103 | 6.1 | Jul 11 | A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which… Affected: before 10.9.0 |
| CVE-2021-29107 | 6.1 | Jul 10 | A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings… Affected: 10.6.1 |
| CVE-2021-29106 | 6.1 | Jul 10 | A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link… Affected: before 10.9.0 |
| CVE-2025-67707 | 5.6 | Dec 31 | Unvalidated File Upload vulnerability in ArcGIS Server. Affected: 10.9.1 through 11.5 |
| CVE-2025-67706 | 5.6 | Dec 31 | Unvalidated File Upload vulnerability in ArcGIS Server. Affected: 10.9.1 through 11.4 |
| CVE-2021-29105 | 5.4 | Jul 11 | A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store… Affected: before 10.9.0 |
| CVE-2026-33522 New | 5.3 | Oct 26 | BUG-000182936 - ArcGIS Server has a security vulnerability. Affected: 11.3 before 12.0 |
| CVE-2026-2812 | 5.3 | May 20 | Improper Authentication issue in ArcGIS Server Affected: 11.1 through 12.0 |
| CVE-2023-25848 | 5.3 | Aug 25 | BUG-000158039 - There is an information disclosure issue in ArcGIS Server. Affected: 10.8.1 through 11.0 |
| CVE-2021-29099 | 5.3 | Jun 7 | A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier Affected: through 10.8.1 |
| CVE-2024-51966 | 4.9 | Mar 3 | Directory traversal vulnerability in ArcGIS Server Affected: all through 11.3 |
| CVE-2024-51958 | 4.9 | Mar 3 | Directory traversal vulnerability in the admin api for service thumbnails Affected: all through 11.3 |
| CVE-2024-51963 | 4.8 | Mar 3 | Stored XSS in ArcGIS Server Manager Affected: all through 11.3 |
| CVE-2024-51960 | 4.8 | Mar 3 | Stored XSS in ArcGIS Server Administrator Directory Affected: all through 11.3 |
| CVE-2024-51959 | 4.8 | Mar 3 | Stored XSS issue in Server Admin API Affected: all through 11.3 |
| CVE-2024-51957 | 4.8 | Mar 3 | Stored XSS vulnerability in ArcGIS Rest Services Directory Affected: all through 11.3 |
| CVE-2024-51956 | 4.8 | Mar 3 | Stored XSS vulnerability in ArcGIS Server Administrator Directory Affected: all through 11.3 |
| CVE-2024-51953 | 4.8 | Mar 3 | Stored XSS in ArcGIS Server Rest services Affected: all through 11.3 |
| CVE-2024-51952 | 4.8 | Mar 3 | Stored XSS issue in ArcGIS Server Affected: all through 11.3 |
| CVE-2024-51951 | 4.8 | Mar 3 | Stored XSS in Server Admin API Affected: all through 11.3 |
| CVE-2024-51950 | 4.8 | Mar 3 | Stored XSS in Server Admin under Services > lifecycleinfos Affected: all through 11.3 |
| CVE-2024-51949 | 4.8 | Mar 3 | Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service Affected: all through 11.3 |
| CVE-2024-51948 | 4.8 | Mar 3 | Stored XSS vulnerability in Rest Services under Job ID Affected: all through 11.3 |
| CVE-2024-51947 | 4.8 | Mar 3 | Stored XSS vulnerability in Rest Services under Layer name Affected: all through 11.3 |
| CVE-2024-51946 | 4.8 | Mar 3 | Stored XSS in Rest Services Directory under Identify operation Affected: all through 11.3 |
| CVE-2024-51945 | 4.8 | Mar 3 | Stored XSS issues in Server Admin API Affected: all through 11.3 |
| CVE-2024-51944 | 4.8 | Mar 3 | Stored XSS in Rest Services Directory Affected: all through 11.3 |
| CVE-2024-51942 | 4.8 | Mar 3 | Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page Affected: all through 11.3 |
| CVE-2024-10904 | 4.8 | Mar 3 | Stored XSS in Server Admin API Affected: all through 11.3 |