CVE-2026-9181

Think of ArcGIS Server as a filing cabinet that's supposed to only open specific labeled drawers for visitors. This flaw lets a stranger trick the cabinet into opening any drawer — including ones holding the building's master keys — and swapping out what's inside. Once that happens, they effectively control the whole cabinet, not just one drawer.

This matters to you if you run ArcGIS Server on Windows or Linux, version 12.0 or earlier. If you use ArcGIS Enterprise on Kubernetes instead, you are not affected. This is a risk if the server is reachable from the internet, since no login or user interaction is needed to exploit it.

This is a serious flaw — it needs no password and no user to click anything, and it can hand an attacker full control of the server. It is not currently listed as being actively exploited and no public exploit code exists yet, so there is no evidence of attacks happening right now, but this should be treated as a priority to patch before that changes.

Confirm exposure by identifying all ArcGIS Server instances running version 12.0 or prior on Windows or Linux; ArcGIS Enterprise on Kubernetes is confirmed unaffected. Apply the fix detailed in Esri's May 2026 ArcGIS Security Bulletin (https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/may-2026-arcgis-security-bulletin) for your specific branch/version. There is no stated CISA KEV due date since this CVE is not currently in the KEV catalog. As a temporary workaround if patching is delayed, restrict network-level access to ArcGIS Server (firewall/VPN-only access) to eliminate unauthenticated network reachability, since the flaw is reachable in default configuration. Monitor server and file-integrity logs for unexpected file writes/overwrites in system directories, and watch Esri's bulletin and threat intel feeds for any escalation to confirmed exploitation or KEV listing.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, full impact to confidentiality, integrity, and availability. Weakness type: CWE-22 (Path/Directory Traversal) enabling arbitrary file overwrite leading to administrative compromise. No public exploit code is on record and no KEV listing exists; EPSS places likelihood of near-term exploitation in the moderate percentile range with a flat trend, indicating this is currently a predicted rather than confirmed threat. Press attention is rising but tied to the patch release itself, not to reported incidents.