{"id":"CVE-2026-33521","kind":"vulnerability","aliases":["CVE-2026-33521"],"related":[],"title":"Esri ArcGIS Server: crafted requests can exhaust worker threads and stop service","description":"There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.","summary":"Esri ArcGIS Server 12.0 and earlier can be made to consume all available worker threads with crafted requests, under exceptional circumstances. An unauthenticated remote attacker can use this to deny service to users.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arcgis-server","gis","other","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the installed ArcGIS Server version in the Server Manager or Admin site and compare it with `12.0` and earlier\n- unknown whether the sources list a specific patch file or build number to verify","fix":"- Apply the Esri patch for ArcGIS Server 12.0, 11.5, 11.3 or 11.1, which are in General Availability or Extended support\n- Upgrade to a supported release if running an unlisted version, since older versions are not patch eligible","status":"open","published_at":"2026-10-26T18:17:46+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:33:48+00:00","updated_at":"2026-10-26T18:33:48+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T18:33:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Esri patch for ArcGIS Server 12.0, 11.5, 11.3 or 11.1, which are in General Availability or Extended support\n- Upgrade to a supported release if running an unlisted version, since older versions are not patch eligible","reach":"internet","title":"Esri ArcGIS Server: crafted requests can exhaust worker threads and stop service","impact":"low","summary":"Esri ArcGIS Server 12.0 and earlier can be made to consume all available worker threads with crafted requests, under exceptional circumstances. An unauthenticated remote attacker can use this to deny service to users.","category":"other","nicknames":[],"who_cares":["arcgis-server","self-hosted","gis"],"confidence":0.6,"needs_auth":"no","worst_case":"Worker threads exhausted, denying service to legitimate users","analyst_note":"Check the Esri security bulletin for the exact patched build numbers and whether the exposure needs a specific service or configuration.","how_to_check":"- Check the installed ArcGIS Server version in the Server Manager or Admin site and compare it with `12.0` and earlier\n- unknown whether the sources list a specific patch file or build number to verify","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"ArcGIS Server installations on version 12.0 or earlier are described as affected, and the sources say exploitation needs exceptional circumstances. Teams running a supported patched release or a managed hosted ArcGIS service that the vendor operates can skip it. unknown whether the sources name a specific configuration that makes the exposure worse.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00064,"input_tokens":3410,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-33521':15A,18A '11.1':123C '11.3':121C '11.5':120C '12.0':30B,72C,119C 'advis':143C 'allow':77C 'appli':147C 'arcgi':2A,20B,28B,69C,106C 'arcgis-serv':19B 'attack':51B,81C 'avail':39B,93C,111C 'circumst':47B,90C 'consum':37B,91C 'craft':4A,43B,84C 'cve':13A,16A 'deni':56B,97C 'denial':63C 'earlier':32B 'elig':136C 'esri':1A,27B,68C 'except':46B,89C 'exhaust':7A 'extend':113C 'general':110C 'gis':22B 'host':26B 'includ':117C 'made':35B 'matur':128C 'may':76C,87C 'patch':102C,135C,149C 'prior':74C 'provid':104C 'remot':50B,79C 'request':5A,44B,85C 'retir':130C 'self':25B 'self-host':24B 'server':3A,21B,29B,70C,107C 'servic':12A,57B,65C,98C 'softwar':108C 'status':115C,131C 'stop':11A 'suppli':83C 'support':114C 'thread':9A,41B,95C 'unauthent':49B,80C 'unlist':140C 'upgrad':145C 'use':53B 'user':59B,100C,137C 'version':71C,118C,125C,141C 'vulner':66C 'work':138C 'worker':8A,40B,94C","nicknames":[],"mitigations":[],"who_affected":"ArcGIS Server installations on version 12.0 or earlier are described as affected, and the sources say exploitation needs exceptional circumstances. Teams running a supported patched release or a managed hosted ArcGIS service that the vendor operates can skip it. unknown whether the sources name a specific configuration that makes the exposure worse.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@esri.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-33521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33521","severity":null,"published_at":"2026-10-26T18:17:46+00:00","modified_at":"2026-10-26T18:31:27+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}