Esri ArcGIS Server: SQL injection allows database functions to be executed
Summary
Esri ArcGIS Server contains a critical SQL injection vulnerability (CWE-89, CVSS 3.1 9.8). A remote attacker who can reach the service can run database-specific functions that should not be allowed. Exposure is much greater for services configured with public access, where no login may be needed. Esri has released a patch for supported versions.
Affected
- Esri ArcGIS Server 12.1 and earlier on Windows and Linux (Esri description)
- Range conflict: the CVE.org/CNA data lists 11.1 up to but not including 12.1, and VulDB lists up to 12.0. Treat all versions up to and including 12.1 as affected until Esri clarifies.
- Default configuration: reported as unaffected by the CNA.
Fixed in
- ArcGIS Server Security 2026 Update 3 Patch, released 13 October 2026 (Esri October 2026 security bulletin)
- Patch-eligible versions: 12.1, 12.0, 11.5, 11.3 and 11.1
- Mature or retired versions are not patch-eligible; upgrade them.
- Exact patched build numbers: Unknown. Confirm them with Esri before rollout.
Workaround
- No vendor workaround known.
- Until patched, stop anonymous access to affected services.
- Restrict access to the ArcGIS Server web endpoints (VPN or allow-list).
Exploitation
- No confirmed exploitation in the wild.
- Not listed in CISA KEV.
- CISA SSVC data: exploitation none, automatable recorded inconsistently, technical impact total.
- An unverified social-media post claims a public exploit. It is not confirmed.
Our recommendation
- Patch with the Security 2026 Update 3 Patch, prioritising internet-facing or public-access instances.
- Confirm the exact patched build numbers with Esri before rollout.
- Inventory all ArcGIS Server instances, including those run by partners or municipal GIS teams.
- Upgrade mature or retired versions.
- Until patched, disable anonymous access and restrict network exposure.
- Monitor database and web logs for unusual query errors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Esri October 2026 ArcGIS Security Bulletin www.esri.com
- OpenCVE CVE-2026-10757 app.opencve.io
- Tenable CVE-2026-10757 www.tenable.com
- VulDB 426582 vuldb.com
- Feedly CVE-2026-10757 feedly.com
- GitHub Advisory GHSA-34qg-vwfc-f4rm github.com
- Malware.news advisory AV26-1088 (Canadian Centre for Cyber Security) malware.news
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:33.
Original description (NVD)
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.