---
id: "CVE-2026-33521"
kind: "vulnerability"
aliases: ["CVE-2026-33521"]
title: "Esri ArcGIS Server: crafted requests can exhaust worker threads and stop service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["arcgis-server", "gis", "other", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-26T18:17:46+00:00"
first_seen_at: "2026-10-26T18:31:44+00:00"
updated_at: "2026-10-26T18:33:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33521", "first_seen_at": "2026-10-26T18:31:44+00:00"}]
---

# Esri ArcGIS Server: crafted requests can exhaust worker threads and stop service

Esri ArcGIS Server 12.0 and earlier can be made to consume all available worker threads with crafted requests, under exceptional circumstances. An unauthenticated remote attacker can use this to deny service to users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ArcGIS Server version in the Server Manager or Admin site and compare it with `12.0` and earlier
- unknown whether the sources list a specific patch file or build number to verify

## Fix

- Apply the Esri patch for ArcGIS Server 12.0, 11.5, 11.3 or 11.1, which are in General Availability or Extended support
- Upgrade to a supported release if running an unlisted version, since older versions are not patch eligible

## Timeline

- 2026-10-26T18:31:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-33521

## From the sources

There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_