Esri vulnerabilities
177 CVEs and advisories name Esri as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33518Incorrect privilege assignment in Portal for ArcGIS
- CVE-2026-1446XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier
- CVE-2025-67711Reflected XSS vulnerability in ArcGIS Server.
- CVE-2025-67710Stored XSS vulnerability in ArcGIS Server
- CVE-2025-67709There is a cross site scripting issue in ArcGIS Server.
- CVE-2025-67708Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
- CVE-2025-67707Unvalidated File Upload vulnerability in ArcGIS Server.
- CVE-2025-67706Unvalidated File Upload vulnerability in ArcGIS Server.
- CVE-2025-67705Reflected XSS vulnerability in ArcGIS Server.
- CVE-2025-67704Stored XSS vulnerability in ArcGIS Server.
- CVE-2025-67703Stored XSS vulnerability in ArcGIS Server.
- CVE-2025-67712HTML injection issue in ArcGIS Web App Builder
- CVE-2025-57870BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.
- CVE-2025-57871BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)
- CVE-2025-57872BUG-000174150 - Unvalidated redirect in Portal for ArcGIS.
- CVE-2025-57873BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.
- CVE-2025-57874BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS. (11.3, 11.1, 10.9.1)
- CVE-2025-57875BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.
- CVE-2025-57877Reflected XSS vulnerability in Portal for ArcGIS.
- CVE-2025-57878BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.
- CVE-2025-57879BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.
- CVE-2025-57876Stored XSS vulnerability in Portal for ArcGIS
- CVE-2025-55107BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.
- CVE-2025-55106BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.
- CVE-2025-55105BUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.
- CVE-2025-55104BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.
- CVE-2025-55103BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.
- CVE-2025-4967Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS
- CVE-2025-2538BUG-000174336
- CVE-2024-51966Directory traversal vulnerability in ArcGIS Server