Vulnerability · Published May 20, 2026 · Assigned by Esri
CVE-2026-2812Improper Authentication issue in ArcGIS Server
Medium 5.3
In plain English
A medium-severity improper authentication in ArcGIS Server from Esri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 70.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Esri | ArcGIS Server | 11.1 – through 12.0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N