AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

EsriCVE-2026-9182

Esri ArcGIS Server: arbitrary file upload

Esri

CVE-2026-9182 · Published Jul 6, 2026 · updated Jul 8, 2026

Critical9.8
No fix yet
Esri advisory

Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.

Affected versions

PackageAffectedFixed in
ArcGIS Server
Product
<= 12.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-434

More Esri advisories

All Esri
Medium 5.5Aug 21Esri Portal for ArcGIS: cross-site scriptingCVE-2026-69232no fix yetMedium 5.5Aug 21Esri Portal for ArcGIS: cross-site scriptingCVE-2026-69231no fix yetMedium 5.5Aug 21Esri Portal for ArcGIS: cross-site scriptingCVE-2026-69230no fix yetHigh 8.1Jul 7Esri Portal for ArcGIS: weak password recoveryCVE-2026-13020fixed in 12.1Critical 9.8Jul 7Esri Portal for ArcGIS: missing authenticationCVE-2026-13019fixed in 12.1Critical 9.8Jul 6Esri ArcGIS Server: path traversalCVE-2026-9181no fix yet