How many Esri arcgis pro CVEs are in CISA KEV?

None of Esri arcgis pro's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Esri arcgis pro are affected?

11 distinct Esri arcgis pro versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Esri arcgis pro CVEs?

Esri arcgis pro's CVEs most often map to these CWE weakness types: CWE-122 (Heap-based Buffer Overflow), CWE-416 (Use After Free), CWE-426 (Untrusted Search Path), CWE-732 (Incorrect Permission Assignment for Critical Resource).

What is the average severity of Esri arcgis pro CVEs?

The average CVSS base score across Esri arcgis pro's scored CVEs is 7.2.

Esri arcgis pro Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Esri arcgis pro vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Esri arcgis pro Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

Esri arcgis pro has 6 published CVE records since 2021, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Esri arcgis pro, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include windows, x64, x64 windows.

Severity and exploitation

How the CVSS severity of Esri arcgis pro's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High5

Medium1

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of Esri arcgis pro's CVEs are currently listed in CISA's KEV catalog.

Public exploits

No Esri arcgis pro CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every Esri arcgis pro version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

<= 2.73 CVEs
3.3 <= v <= 3.32 CVEs
3.4 <= v <= 3.42 CVEs
All <= v < 4.7.22 CVEs
< 3.6.11 CVE
>= 3.4.01 CVE
1.0 <= v < 3.6.11 CVE
3.3.0 <= v <= 3.3.21 CVE

Fixed in

4.7.22 CVEs
> 3.3.21 CVE
3.6.11 CVE

Find a version

6 CVEs

Sort

XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier
CVE-2026-1446
Patch
CWE-79
Medium · CVSS 5.0
EPSS 0.2% (5th pct)2026-01-26
There is a code injection vulnerability in Esri ArcGIS AllSource
CVE-2025-1068CWE-426
High · CVSS 7.3
EPSS 0.2% (11th pct)2025-02-25
There is a code injection vulnerability in ArcGIS Pro
CVE-2025-1067
Patch
CWE-732
High · CVSS 7.3
EPSS 0.2% (8th pct)2025-02-25
High vulnerability · 2021-03-25
CVE-2021-29098
Patch
CWE-824
High · CVSS 7.8
EPSS 2.0% (79th pct)2021-03-25
High vulnerability · 2021-03-25
CVE-2021-29097
Patch
CWE-122
High · CVSS 7.8
EPSS 2.4% (83th pct)2021-03-25
High vulnerability · 2021-03-25
CVE-2021-29096
Patch
CWE-416
High · CVSS 7.8
EPSS 1.5% (73th pct)2021-03-25

Common weakness types

The CWE weakness categories most often found in Esri arcgis pro CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Esri arcgis pro CVEs were published each year.

2021

2025

2026

Other Esri products

Browse vulnerabilities for other products by Esri.

Portal for ArcGIS88 CVEs arcgis server70 CVEs ArcGIS Enterprise13 CVEs arcreader6 CVEs Portal for ArcGIS Enterprise Sites5 CVEs arcmap4 CVEs ArcGIS Desktop3 CVEs ArcGIS Desktop Background Geoprocessing

Frequently asked questions

Common questions about Esri arcgis pro vulnerabilities.

How many CVEs does Esri arcgis pro have?: Esri arcgis pro has 6 published CVE records since 2021.
How many Esri arcgis pro CVEs are in CISA KEV?: None of Esri arcgis pro's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Esri arcgis pro vulnerabilities?: No Esri arcgis pro CVEs currently have a tracked public exploit in this dataset.
Which versions of Esri arcgis pro are affected?: 11 distinct Esri arcgis pro versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Esri arcgis pro CVEs?: Esri arcgis pro's CVEs most often map to these CWE weakness types: CWE-122 (Heap-based Buffer Overflow), CWE-416 (Use After Free), CWE-426 (Untrusted Search Path), CWE-732 (Incorrect Permission Assignment for Critical Resource).
What is the average severity of Esri arcgis pro CVEs?: The average CVSS base score across Esri arcgis pro's scored CVEs is 7.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Esri arcgis pro vulnerabilities

Monitor new Esri arcgis pro vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing