Esri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public ยท updates https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757 A SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux lets a remote attacker with access to a service issue database-specific functions that should not be allowed. If the service is configured with public access, that includes anonymous attackers. Esri rates it CVSS 3.1 9.8 and fixed it in the ArcGIS Server Security 2026 Update 3 Patch (released Oct 13) for 12.1, 12.0, 11.5, 11.3 and 11.1; older mature or retired versions get no patch and should upgrade to an LTS release. en Mon, 26 Oct 2026 00:00:00 GMT Esri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public: CVE-2026-10757 published on NVD: SQL injection (CWE-89), CVSS 3.1 9.8, reachable anonymously when a service is configured as public. https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757 https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757#2026-10-26-2e4c0024 Mon, 26 Oct 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-10757">Source</a></p> Esri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public: NVD also publishes the companion bugs fixed by the same Update 3 patch: CVE-2026-33521 (CVSS 7.5, unauthenticated DoS exhausting worker threads, 12.0 and earlier), CVE-2026-33522 (CVSS 5.3, unauthenticated service metadata update, 11.3 to 12.0), and reflected/stored XSS CVE-2026-33520, CVE-2026-50095 and CVE-2026-50096 (CVSS 6.1 each). https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757 https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757#2026-10-26-91791298 Mon, 26 Oct 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-33521">Source</a></p> Esri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public: Esri releases the ArcGIS Server Security 2026 Update 3 Patch, a cumulative fix for one critical, one high and several moderate ArcGIS Server bugs, and urges customers to install it ASAP. https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757 https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757#2026-10-13-6cb885a8 Tue, 13 Oct 2026 00:00:00 GMT critical <p><a href="https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/october-2026-arcgis-security-bulletin">Source</a></p>