CVE-2026-2812

🔶 medium

Summary

ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier.

CVSS Score

5.3

Medium

EPSS Score

0.1

Exploit Probability

Published Date

2026-05-20

First Seen: 2026-05-21

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 19.7% of all 328,009 vulnerabilities in our database.

#263,349

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 20, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-05-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE IDs (Weakness Types)

CWE-287

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
esri	arcgis_server	Affected	> 11.1 < 12.0

🔗 References 1

https://www.esri.com/arcgis-blog/products/trust-arcg...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-2813	🔶 medium	4.7	0.0	ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could e...	2026-05-20
CVE-2025-67703	🔶 medium	6.1	0.1	There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co...	2025-12-31
CVE-2025-67704	🔶 medium	6.1	0.1	There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co...	2025-12-31
CVE-2025-67705	🔶 medium	6.1	0.1	There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co...	2025-12-31
CVE-2025-67706	🔶 medium	5.6	0.1	ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a rem...	2025-12-31
CVE-2025-67707	🔶 medium	5.6	0.3	ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a rem...	2025-12-31

These CVEs affect the same products