Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Esri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public

Esri ArcGIS Server

A SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux lets a remote attacker with access to a service issue database-specific functions that should not be allowed. If the service is configured with public access, that includes anonymous attackers. Esri rates it CVSS 3.1 9.8 and fixed it in the ArcGIS Server Security 2026 Update 3 Patch (released Oct 13) for 12.1, 12.0, 11.5, 11.3 and 11.1; older mature or retired versions get no patch and should upgrade to an LTS release.

Why this severity: CVSS 3.1 9.8 (Esri); no reported exploitation

Started
Oct 13, 2026
CVEs
CVE-2026-10757CVE-2026-33521CVE-2026-33522CVE-2026-33520CVE-2026-50095CVE-2026-50096

Follow this incident

Discuss on X ↗

Affected

  • ArcGIS Server 12.1, 12.0, 11.5, 11.3, 11.1 (Windows and Linux) without the 2026 Update 3 patch
  • ArcGIS Server 11.4, 11.2 and earlier (mature/retired, no patch)

Fixed in

  • ArcGIS Server Security 2026 Update 3 Patch (cumulative) for 12.1, 12.0, 11.5, 11.3, 11.1

Timeline3

  1. CVE-2026-10757 published on NVD: SQL injection (CWE-89), CVSS 3.1 9.8, reachable anonymously when a service is configured as public.

  2. NVD also publishes the companion bugs fixed by the same Update 3 patch: CVE-2026-33521 (CVSS 7.5, unauthenticated DoS exhausting worker threads, 12.0 and earlier), CVE-2026-33522 (CVSS 5.3, unauthenticated service metadata update, 11.3 to 12.0), and reflected/stored XSS CVE-2026-33520, CVE-2026-50095 and CVE-2026-50096 (CVSS 6.1 each).

  3. Esri releases the ArcGIS Server Security 2026 Update 3 Patch, a cumulative fix for one critical, one high and several moderate ArcGIS Server bugs, and urges customers to install it ASAP.

Advisories2

Notes & caveats

Mitigations from Esri besides patching: a WAF helps block malicious patterns, and applying the basic profile of the ArcGIS Hardening guide reduces exposure. Check whether any services are shared with public (anonymous) access. The same patch also fixes CVE-2026-33521 (CVSS 7.5, unauthenticated DoS), CVE-2026-33522 (CVSS 5.3, unauthenticated metadata update) and XSS bugs CVE-2026-33520, CVE-2026-50095 and CVE-2026-50096.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo