{"id":"CVE-2026-10757","published":"2026-10-26T18:17:34.580","lastModified":"2026-10-27T04:17:42.280","description":"There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/october-2026-arcgis-security-bulletin","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection flaw (CWE-89) exists in Esri ArcGIS Server versions 12.1 and earlier, allowing authenticated or potentially anonymous attackers to execute unauthorized database-specific functions due to insufficient input validation.","exploitability":"Exploitation requires valid service access credentials or public-facing service misconfiguration; no authentication bypass is needed beyond standard service access.","blast_radius":"Successful exploitation could lead to full compromise of the underlying database, including data exfiltration, modification, or destruction, depending on database permissions tied to the ArcGIS service account.","remediation":"Upgrade to ArcGIS Server version 12.2 or later (the first patched release), or apply the official patch for supported versions (12.1, 12.0, 11.5, 11.3, 11.1); unpatched mature/retired versions must be upgraded to a supported release.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","esri","arcgis","auth-bypass","db-access"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:48:48.240Z"}}