# Esri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public · pwn.watch

> A SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux lets a remote attacker with access to a service issue database-specific functions that should not be allowed. If the service is configured with public access, that includes anonymous attackers. Esri rates it CVSS 3.1 9.8 and fixed it in the ArcGIS Server Security 2026 Update 3 Patch (released Oct 13) for 12.1, 12.0, 11.5, 11.3 and 11.1; older mature or retired versions get no patch and should upgrade to an LTS release.

Page: https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757 · generated 2026-10-26T20:54:06.270Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Esri ArcGIS Server
- Started: 2026-10-13
- CVEs: CVE-2026-10757, CVE-2026-33521, CVE-2026-33522, CVE-2026-33520, CVE-2026-50095, CVE-2026-50096
- Affected: ArcGIS Server 12.1, 12.0, 11.5, 11.3, 11.1 (Windows and Linux) without the 2026 Update 3 patch; ArcGIS Server 11.4, 11.2 and earlier (mature/retired, no patch)
- Fixed in: ArcGIS Server Security 2026 Update 3 Patch (cumulative) for 12.1, 12.0, 11.5, 11.3, 11.1

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757/feed.xml
- JSON Feed: https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757.json
- This file: https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757/llms.txt

## Updates (newest first)
- 2026-10-26: CVE-2026-10757 published on NVD: SQL injection (CWE-89), CVSS 3.1 9.8, reachable anonymously when a service is configured as public. (https://nvd.nist.gov/vuln/detail/CVE-2026-10757)
- 2026-10-26: NVD also publishes the companion bugs fixed by the same Update 3 patch: CVE-2026-33521 (CVSS 7.5, unauthenticated DoS exhausting worker threads, 12.0 and earlier), CVE-2026-33522 (CVSS 5.3, unauthenticated service metadata update, 11.3 to 12.0), and reflected/stored XSS CVE-2026-33520, CVE-2026-50095 and CVE-2026-50096 (CVSS 6.1 each). (https://nvd.nist.gov/vuln/detail/CVE-2026-33521)
- 2026-10-13: Esri releases the ArcGIS Server Security 2026 Update 3 Patch, a cumulative fix for one critical, one high and several moderate ArcGIS Server bugs, and urges customers to install it ASAP. (https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/october-2026-arcgis-security-bulletin)

## Fix brief
# Security brief: Esri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public

Source: https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757 · status: live · severity: critical · updated Oct 26, 2026, 20:29 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux lets a remote attacker with access to a service issue database-specific functions that should not be allowed. If the service is configured with public access, that includes anonymous attackers. Esri rates it CVSS 3.1 9.8 and fixed it in the ArcGIS Server Security 2026 Update 3 Patch (released Oct 13) for 12.1, 12.0, 11.5, 11.3 and 11.1; older mature or retired versions get no patch and should upgrade to an LTS release.

Severity detail: CVSS 3.1 9.8 (Esri); no reported exploitation

- Product: Esri ArcGIS Server
- CVE / advisory ids: CVE-2026-10757, CVE-2026-33521, CVE-2026-33522, CVE-2026-33520, CVE-2026-50095, CVE-2026-50096

## Affected versions
- ArcGIS Server 12.1, 12.0, 11.5, 11.3, 11.1 (Windows and Linux) without the 2026 Update 3 patch
- ArcGIS Server 11.4, 11.2 and earlier (mature/retired, no patch)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- ArcGIS Server Security 2026 Update 3 Patch (cumulative) for 12.1, 12.0, 11.5, 11.3, 11.1

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Oct 26, 2026: CVE-2026-10757 published on NVD: SQL injection (CWE-89), CVSS 3.1 9.8, reachable anonymously when a service is configured as public.
- Oct 26, 2026: NVD also publishes the companion bugs fixed by the same Update 3 patch: CVE-2026-33521 (CVSS 7.5, unauthenticated DoS exhausting worker threads, 12.0 and earlier), CVE-2026-33522 (CVSS 5.3, unauthenticated service metadata update, 11.3 to 12.0), and reflected/stored XSS CVE-2026-33520, CVE-2026-50095 and CVE-2026-50096 (CVSS 6.1 each).
- Oct 13, 2026: Esri releases the ArcGIS Server Security 2026 Update 3 Patch, a cumulative fix for one critical, one high and several moderate ArcGIS Server bugs, and urges customers to install it ASAP.

## Advisories
- [October 2026 ArcGIS Security Bulletin](https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/october-2026-arcgis-security-bulletin) (Esri)
- [NVD: CVE-2026-10757](https://nvd.nist.gov/vuln/detail/CVE-2026-10757) (NVD)

## Caveats
Mitigations from Esri besides patching: a WAF helps block malicious patterns, and applying the basic profile of the ArcGIS Hardening guide reduces exposure. Check whether any services are shared with public (anonymous) access. The same patch also fixes CVE-2026-33521 (CVSS 7.5, unauthenticated DoS), CVE-2026-33522 (CVSS 5.3, unauthenticated metadata update) and XSS bugs CVE-2026-33520, CVE-2026-50095 and CVE-2026-50096.

---
Machine-readable: https://pwn.watch/i/esri-arcgis-server-sqli-cve-2026-10757.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.