Esri ArcGIS Server Improper Access Control Vulnerability Allowing Unauthorized Access to Secure Services

A vulnerability exists in ArcGIS Server on Windows and Linux, in versions 11.3 and prior. This issue involves improper access control, which could, under certain conditions, enable a remote, low-privileged authenticated attacker to access secure services on a standalone (unfederated) ArcGIS Server instance. Successful exploitation of this vulnerability could significantly compromise confidentiality, while having a minor impact on integrity and no effect on availability.

Impact

Exploitation of this vulnerability could lead to unauthorized access to secure services, with a significant risk to confidentiality.

Remediation

Users are advised to apply the ArcGIS Server Security 2025 Update 1 Patch, available through the Esri Support website, to address this vulnerability.