CVE-2025-67710 — Stored XSS vulnerability in ArcGIS Server

CVE-2025-67710

Stored XSS vulnerability in ArcGIS Server PUBLISHED

Description (CNA)

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

Affected (CNA)

Vendor / product	Versions
Esri / ArcGIS Server	affected 10.9.1 through 11.4

CWE

CWE-79

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-2-patch

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.