Live › vulnerability › CVE-2026-33521
Go to dashboardEsri ArcGIS Server 12.0 and earlier can be made to consume all available worker threads with crafted requests, under exceptional circumstances. An unauthenticated remote attacker can use this to deny service to users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
ArcGIS Server installations on version 12.0 or earlier are described as affected, and the sources say exploitation needs exceptional circumstances. Teams running a supported patched release or a managed hosted ArcGIS service that the vendor operates can skip it. unknown whether the sources name a specific configuration that makes the exposure worse.
No product ranges from the sources yet.
12.0 and earlierEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
This page as .md · .json · in your agent: get_signal("CVE-2026-33521")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.