ArcGIS Server Directory Traversal and Unrestricted File Upload Vulnerabilities (CVE-2026-9181/9182)

Vulnerability Overview CVE-2026-9181: ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker can exploit this issue by sending crafted path parameters, potentially leading to access to sensitive files on the system. CVE-2026-9182: ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker can exploit this issue by uploading crafted files to the affected endpoint, potentially leading to arbitrary file upload. Affected Products CVE-2026-9181: Affects ArcGIS Server 12.0 and earlier versions. CVE-2026-9182: Affects ArcGIS Server 12.0 and earlier versions. Remediation Cumulative Patch: The ArcGIS Server Security 2026 Update 2 Patch has been released to address the aforementioned vulnerabilities. ArcGIS Enterprise customers are strongly advised to apply this patch within two weeks to minimize risk. Mitigation: - CVE-2026-9181: This vulnerability can be mitigated immediately by deploying a Web Application Firewall (WAF) and using the recommended rule set referenced in the enterprise hardening guide. - CVE-2026-9182: No specific mitigation measures are mentioned, but installing the patch as soon as possible is recommended. Additional Information Publication Date: May 27, 2026 Authors: Mark Bierman, Randall Williams, Michael Young Category: ArcGIS Blog, Administration, ArcGIS Enterprise Vulnerability Details CVE-2026-9181 Description: ArcGIS Server contains a directory traversal vulnerability. Mitigation: Deploy a Web Application Firewall (WAF) and use the recommended rule set referenced in the enterprise hardening guide. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Base CVSSv3.1: 9.8 Temporal CVSSv3.1: 9.4 Affected Versions: ArcGIS Server 12.0 and earlier versions CVE-2026-9182 Description: ArcGIS Server contains an unrestricted file upload vulnerability. CWE-434: Unrestricted Upload of File with Dangerous Type Base CVSSv3.1: 5.3 Temporal CVSSv3.1: 5.1 Affected Versions: ArcGIS Server 12.0 and earlier versions Summary ArcGIS Server 12.0 and earlier versions contain two severe security vulnerabilities: directory traversal and unrestricted file upload. Users are advised to install the ArcGIS Server Security 2026 Update 2 Patch as soon as possible to resolve these issues. For the directory traversal vulnerability, temporary mitigation can be achieved by deploying a WAF.

Goal Reached Thanks to every supporter — we hit 100%!

ArcGIS Server Directory Traversal and Unrestricted File Upload Vulnerabilities (CVE-2026-9181/9182)