arcgis server vulnerabilities and fixes

Recent CVEs affecting arcgis server, with upgrade or downgrade steps. 2 tracked.

Also searched as: arcgisserver.

arcgis server has 2 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-07-06. Highest priority: CVE-2026-9181 (score 59/100).

• CVE-2026-9181 CRITICAL 9.8 UPGRADE Esri ArcGIS Server contains a directory traversal vulnerability
• CVE-2026-9182 CRITICAL 9.8 UPGRADE Esri ArcGIS Server contains an unrestricted file upload vulnerability

FAQ

How do I fix arcgis server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is arcgis server being exploited right now?

None of the tracked arcgis server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which arcgis server CVE should I patch first?

CVE-2026-9181 currently ranks highest (59/100): Esri ArcGIS Server contains a directory traversal vulnerability.

← Back to latest CVEs