External risk intelligence

Esri ArcGIS Server SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-10757

ArcGIS Server is commonly deployed as a web-facing service to publish, manage, and share geospatial data and mapping APIs. While specific configurations can restrict access, the product is designed to function as an externally reachable gateway or web endpoint, making public-internet exposure of the vulnerable interface a common deployment pattern.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in Esri ArcGIS Server software. This SQL injection flaw could potentially allow unauthorized individuals to execute database commands, which may lead to the compromise of sensitive information or system functions. While specific configurations can limit exposure, the nature of the technology suggests a potential for broad impact if not addressed.

SQL injection in ArcGIS Server.
Critical flaw, widely used geospatial platform.
Confirm relevance and address exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to an exposed ArcGIS Server service. This could allow them to execute arbitrary database commands, potentially leading to unauthorized access to sensitive information or manipulation of data.

Entry Condition: Network access to a public service.
Trigger Point: Sending malicious SQL commands.
Resulting Risk: Unauthorized database access and modification.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in Esri ArcGIS Server could allow an unauthenticated remote attacker to execute unauthorized database functions when services are configured for public access. This could potentially expose sensitive information or alter database behavior.

Sensitive database information.
Unauthorized database commands issued.
Data integrity or confidentiality compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and application owners are responsible for addressing this SQL injection vulnerability in ArcGIS Server. The immediate priority is to identify all instances of the affected software, determine their business criticality and network exposure, and confirm the accountable system owner. This information will inform a risk-based remediation plan, which may involve patching, upgrading, or implementing compensating controls.

Own the issue by confirming asset inventory.
Verify external exposure and business impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Esri ArcGIS Server?

Esri ArcGIS Server is a professional platform used to publish, host, and manage geospatial data, interactive maps, and location-based services. Organizations deploy it to provide mapping APIs and data processing capabilities to internal teams or public users, functioning as a critical gateway for spatial analytics and geographic information systems.

How does CVE-2026-10757 cause a security risk?

This vulnerability is classified as a SQL injection (CWE-89). It occurs when an application improperly handles user input, allowing an attacker to inject and execute unauthorized database commands. In this case, the flaw could enable unauthorized individuals to bypass intended restrictions and interact with the underlying database in ways that should be blocked.

What triggers this SQL injection flaw?

An attacker triggers the vulnerability by sending specially crafted requests to an ArcGIS Server instance. This does not occur through standard, legitimate administrative use. The vulnerability requires network access to the server, and while it is most potent when services are configured for public access, internal-only services may still be at risk if an attacker has established a foothold on the local network.

Do I need to worry if my ArcGIS Server is internal?

Halo Surface Signal notes that ArcGIS Server is often deployed as a web-facing service, making internet-exposed instances a primary concern. While external-facing servers are more easily reached by remote attackers, internal instances remain a risk if an attacker gains access to your private network. You should evaluate your specific deployment architecture to determine the accessibility of your GIS endpoints.

When should I prioritize patching ArcGIS Server?

You should prioritize this immediately by first identifying all running instances in your inventory. Verify if your version is eligible for the provided patch—specifically versions 11.1 through 12.1—and schedule the update. For older or retired versions that are not patch-eligible, you must plan an upgrade to a supported version or implement compensating controls to mitigate the risk of unauthorized database access.

References

www.esri.com/arcgis-blog/products/trust-arcgis/administration/octo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.