Esri
Security incidents tagged Esri. Newest first.
1 Esri incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 13
- Longest quiet run: 12 days (Oct 14–Oct 25)
- Patched
Esri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public
A SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux lets a remote attacker with access to a service issue database-specific functions that should not be allowed. If the service is configured with public access, that includes anonymous attackers. Esri rates it CVSS 3.1 9.8 and fixed it in the ArcGIS Server Security 2026 Update 3 Patch (released Oct 13) for 12.1, 12.0, 11.5, 11.3 and 11.1; older mature or retired versions get no patch and should upgrade to an LTS release.
Esri ArcGIS ServerSince Oct 13, 2026
