Product by Esri

    Esri ArcGIS Server

    76 known vulnerabilities in Esri ArcGIS Server (Esri), 0 of them actively exploited (CISA KEV).

    Key figures

    76

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Esri ArcGIS Server (Esri)
    CriticalCVE-2020-35712

    Esri ArcGIS Server: Server-Side Request Forgery (SSRF)

    		9.8
    CriticalCVE-2026-9181

    Directory Traversal in ArcGIS Server

    also in 1 other product

    		7.5
    CriticalCVE-2021-29102

    Esri ArcGIS Server: Server-Side Request Forgery (SSRF)

    		9.1
    CriticalCVE-2026-9182

    Esri ArcGIS Server: Unrestricted Upload of File with Dangerous Type

    also in 1 other product

    		9.8
    HighCVE-2022-38202

    Esri ArcGIS Server: Relative Path Traversal

    		7.5
    MediumCVE-2021-29115

    An information disclosure vulnerability

    also in 1 other product

    		5.3
    CriticalCVE-2026-10757

    Esri ArcGIS Server: SQL Injection

    also in 1 other product

    		9.8
    CriticalCVE-2025-57870

    Esri ArcGIS Server: SQL Injection

    		10.0
    HighCVE-2022-38196

    BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability

    		6.5
    CriticalCVE-2021-29114

    SQL injection vulnerability in ArcGIS Server

    		7.3
    HighCVE-2026-33521

    Esri ArcGIS Server: Uncontrolled Resource Consumption

    also in 1 other product

    		7.5
    Not ratedCVE-2012-4949

    Esri ArcGIS Server: SQL Injection

    		—
    HighCVE-2024-51962

    SQL injection vulnerability in ArcGIS Server

    		8.7
    MediumCVE-2021-29094

    ArcGIS Server image service and raster analytics security update: buffer overflow

    		6.4
    MediumCVE-2021-29093

    ArcGIS Server image service and raster analytics security update: use-after-free

    		6.4
    MediumCVE-2021-29095

    ArcGIS Server image service and raster analytics security update: uninitialized pointer

    		6.4
    MediumCVE-2026-50096

    Esri ArcGIS Server: Cross-site Scripting

    also in 1 other product

    		6.1
    MediumCVE-2026-50095

    Esri ArcGIS Server: Cross-site Scripting

    also in 1 other product

    		6.1
    MediumCVE-2026-33520

    Esri ArcGIS Server: Cross-site Scripting

    also in 1 other product

    		6.1
    HighCVE-2024-51961

    Local file inclusion (LFI) vulnerability in ArcGIS Server

    		7.5
    MediumCVE-2021-29107

    Esri ArcGIS Server: Cross-site Scripting

    		6.1
    Not ratedCVE-2014-5121

    Esri ArcGIS Server: Cross-Site Scripting (XSS)

    		—
    MediumCVE-2026-33522

    Esri ArcGIS Server: Improper Authorization

    also in 1 other product

    		5.3
    MediumCVE-2021-29116

    BUG-000142180 Hosted feature services vulnerable to stored XSS

    		6.1
    MediumCVE-2021-29104

    Esri ArcGIS Server: Cross-site Scripting

    		6.1

    All vulnerabilities in search

    News

    All products by Esri