Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-10757— BUG-000187511 - ArcGIS Server has a security vulnerability.

Quick assessment

Affected
Esri ArcGIS Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Esri ArcGIS Server 在 Windows 和 Linux 平台上的 12.1 及更早版本中存在 SQL 注入漏洞。该漏洞可能允许拥有相应权限的远程攻击者（若服务被配置为非默认的“公开”访问模式，则甚至可能包括匿名攻击者）访问该服务，并执行本不应被允许的数据库特定函数。针对处于通用支持（General Availability）和扩展支持（Extended Support）状态的 ArcGIS Server 软件（涵盖 12.1、12.0、11.5、11.3 和 11.1 版本），Esri 已提供修复

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-10757

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
BUG-000187511 - ArcGIS Server has a security vulnerability.
Source: CVE Program / CVE List V5
Vulnerability Description
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Esri ArcGIS Server 11.1 ~ 12.1 -

II. Public POCs for CVE-2026-10757

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-10757

请登录查看更多情报信息。

Other References for CVE-2026-10757 (1)

Same Patch Batch · Esri · 2026-10-26 · 6 CVEs total

CVE-2026-33521 7.5 HIGH BUG-000186514 - ArcGIS Server has a security vulnerability.
CVE-2026-33520 6.1 MEDIUM BUG-000185167 - ArcGIS Server has a security vulnerability.
CVE-2026-50096 6.1 MEDIUM BUG-000187164 - ArcGIS Server has a security vulnerability.
CVE-2026-50095 6.1 MEDIUM BUG-000187165 - ArcGIS Server has a security vulnerability.
CVE-2026-33522 5.3 MEDIUM BUG-000182936 - ArcGIS Server has a security vulnerability.

IV. Related Vulnerabilities

Same product: ArcGIS Server
Same vendor: Esri
Same weakness: CWE-89