Zero Radar
← feed
CriticalVulnerabilityCVE-2026-10757updated 26 Oct 2026, 18:22 UTC

ArcGIS Server database injection flaw lets attackers run unauthorized database commands

A weakness in ArcGIS Server lets someone send specially crafted requests that trick the database into running commands it should refuse. Depending on how services are configured, even anonymous users might be able to reach it.

Fix availableOfficial source
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesPatches are provided for ArcGIS Server 12.1, 12.0, 11.5, 11.3, and 11.1 (General Availability and Extended support versions). Versions in mature or retired status are not patch eligible; users on those should upgrade and apply the patch. · since 26 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends crafted requests to the server
  2. 2ArcGIS ServerInput is not properly sanitized
  3. 3DatabaseReceives injected SQL statements
  4. 4Restricted functionsDatabase functions run that should be blocked
  5. ResultAttacker runs unauthorized database functions

What happened

A SQL injection vulnerability in Esri ArcGIS Server 12.1 and earlier on Windows and Linux allows a remote attacker, possibly with privileges or anonymously on services configured as public, to execute restricted database-specific functions.

Why it is dangerous: A successful attacker could read, change, or misuse data stored behind ArcGIS Server, including map and geospatial data. Organizations that publish GIS services to the internet face the highest risk.

Are you affected?

You are affected if you run ArcGIS Server version 12.1 or earlier on Windows or Linux, especially with services set to a public (non-default) access configuration.

ArcGIS Server 12.1 and earlier on Windows and Linux (all versions at or below 12.1).

What to do

  1. Identify all ArcGIS Server instances and their exact versions
  2. Apply the Esri patch for your supported version (12.1, 12.0, 11.5, 11.3, or 11.1)
  3. Upgrade any unsupported or unlisted version to a patch-eligible release, then apply the patch
  4. Review services set to public access and restrict them where possible until patched

Timeline

  1. 26 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 18:22 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-10757
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 18:17 UTC
On Zero Radar
26 Oct 2026, 18:22 UTC (5 min after disclosure)
Last change
26 Oct 2026, 18:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

ArcGIS Server database injection flaw lets attackers run unauthorized database commands · Zero Radar