How many Esri arcgis server CVEs are in CISA KEV?

None of Esri arcgis server's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Esri arcgis server are affected?

53 distinct Esri arcgis server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Esri arcgis server CVEs?

Esri arcgis server's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-434 (Unrestricted Upload of File with Dangerous Type).

How many critical Esri arcgis server vulnerabilities are there?

Esri arcgis server has 6 critical and 6 high-severity CVEs.

What is the average severity of Esri arcgis server CVEs?

The average CVSS base score across Esri arcgis server's scored CVEs is 5.9.

Esri arcgis server Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Esri arcgis server vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Esri arcgis server Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

Esri arcgis server has 70 published CVE records since 2012, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 3 have a known public exploit. The average CVSS base score across scored CVEs is 5.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Esri arcgis server, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include kubernetes, linux, windows, x64.

Severity and exploitation

How the CVSS severity of Esri arcgis server's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical6

High6

Medium54

Low4

In CISA’s Known Exploited Vulnerabilities catalog

None of Esri arcgis server's CVEs are currently listed in CISA's KEV catalog.

Public exploits

3 of Esri arcgis server's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Esri arcgis server version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

10.9.1 <= v <= 11.323 CVEs
all <= v <= 11.323 CVEs
<= 11.59 CVEs
10.9.1 <= v <= 11.48 CVEs
< 10.9.05 CVEs
<= 10.9.15 CVEs
All <= v < 10.9.05 CVEs
All <= v <= 10.9.15 CVEs
<= 10.8.14 CVEs
10.1 <= v <= 10.14 CVEs
10.8.1 <= v <= 10.8.13 CVEs
<= 10.9.0

Common weakness types

The CWE weakness categories most often found in Esri arcgis server CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Esri arcgis server CVEs were published each year.

2012

2013

2014

2015

2020

2021

2022

Other Esri products

Browse vulnerabilities for other products by Esri.

Portal for ArcGIS88 CVEs ArcGIS Enterprise13 CVEs arcgis pro6 CVEs arcreader6 CVEs Portal for ArcGIS Enterprise Sites5 CVEs arcmap4 CVEs ArcGIS Desktop3 CVEs ArcGIS Desktop Background Geoprocessing

Frequently asked questions

Common questions about Esri arcgis server vulnerabilities.

How many CVEs does Esri arcgis server have?: Esri arcgis server has 70 published CVE records since 2012.
How many Esri arcgis server CVEs are in CISA KEV?: None of Esri arcgis server's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Esri arcgis server vulnerabilities?: Yes — 3 of Esri arcgis server's CVEs have a known public exploit.
Which versions of Esri arcgis server are affected?: 53 distinct Esri arcgis server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Esri arcgis server CVEs?: Esri arcgis server's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-434 (Unrestricted Upload of File with Dangerous Type).
How many critical Esri arcgis server vulnerabilities are there?: Esri arcgis server has 6 critical and 6 high-severity CVEs.
What is the average severity of Esri arcgis server CVEs?: The average CVSS base score across Esri arcgis server's scored CVEs is 5.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Esri arcgis server vulnerabilities

Monitor new Esri arcgis server vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

Esri arcgis server Vulnerabilities