CVE-2026-2812 — Improper Authentication issue in ArcGIS Server

CVE-2026-2812

Improper Authentication issue in ArcGIS Server PUBLISHED

Description (CNA)

ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier.

Affected (CNA)

Vendor / product	Versions
Esri / ArcGIS Server	affected 11.1 through 12.0

CWE

CWE-287

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.