CVEFinder.io

CVE-2026-9181

⛔ critical
🔍 Scan for this CVE
Summary

Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 an

Description

Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.

CVSS Score
9.8
Critical
EPSS Score
0.7
Exploit Probability
Published Date
2026-07-06
First Seen: 2026-07-07
📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.5% of all 349,515 vulnerabilities in our database.

#33,328
Top 10% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 7, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-07-08
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-22

📦 Affected Products 1

Vendor Product Status Affected Versions
esri arcgis_server Affected
< 12.0

🔗 References 1

https://www.esri.com/arcgis-blog/products/arcgis-ent...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-9182 ⛔ critical 9.8 0.4 Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this is... 2026-07-06
CVE-2026-2812 🔶 medium 5.3 0.4 ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthent... 2026-05-20
CVE-2026-2813 🔶 medium 4.7 0.3 ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could e... 2026-05-20
CVE-2025-67703 🔶 medium 6.1 0.1 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co... 2025-12-31
CVE-2025-67704 🔶 medium 6.1 0.1 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co... 2025-12-31
CVE-2025-67705 🔶 medium 6.1 0.1 There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co... 2025-12-31
These CVEs affect the same products