Live › vulnerability › CVE-2026-10757
Go to dashboardArcGIS Server 12.1 and earlier on Windows and Linux has a SQL injection flaw that lets a remote attacker with access to a service issue database-specific functions that should be blocked. Services set to a non-default public access configuration can be reached by anonymous attackers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Teams running ArcGIS Server 12.1 or earlier on Windows or Linux are exposed, and the risk is higher where services are reachable by remote users. Services configured with the non-default public access setting can be reached anonymously, while those requiring authenticated access still need a valid account first. Teams on managed hosting run by others should confirm the vendor has applied the patch.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
This page as .md · .json · in your agent: get_signal("CVE-2026-10757")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.