Denial of Service Vulnerability in Esri ArcGIS Server Software

CVE-2026-33521

What is CVE-2026-33521?

There exists a denial of service vulnerability in Esri ArcGIS Server, specifically in versions 12.0 and earlier. This vulnerability enables a remote, unauthenticated attacker to send specially crafted requests that can consume all available worker threads. As a result, legitimate users may experience service denial. Esri has provided a patch for several affected versions, including 12.0, 11.5, 11.3, and 11.1, while users on older or unlisted versions should upgrade to ensure protection.

References