SQL Injection Vulnerability in Esri ArcGIS Server by Esri

CVE-2026-10757

What is CVE-2026-10757?

A SQL injection flaw exists in Esri's ArcGIS Server versions 12.1 and earlier for both Windows and Linux platforms. This vulnerability potentially enables a remote attacker, who may possess certain privileges, to execute unauthorized database functions. Under specific conditions, even an anonymous user could exploit this vulnerability if the service is configured with non-default access settings. Esri has released patches for affected versions, and users on unsupported versions are strongly urged to update and apply the provided security fixes.

References