Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2025-57870

BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Esri

Description

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Esri ArcGIS Server

Default version status: unaffected

  • 11.3 to ≤ 11.5affected

References