Critical · published October 22, 2025
🚨 A single unauthenticated request can open the floodgates to your database! This SQL Injection vulnerability in Esri ArcGIS Server is a serious threat that allows attackers to execute arbitrary SQL commands. 🔥 Think of it like giving a stranger a key to your office without checking their credentials. They can rearrange everything, delete important files, or even steal sensitive information just by walking in with that key. An attacker exploiting this vulnerability could gain unauthorized access to your Enterprise Geodatabase, leading to potentially devastating data losses. They might modify crucial information or even delete entire datasets, disrupting operations and compromising data integrity.
Think of it like giving a stranger a key to your office without checking their credentials. They can rearrange everything, delete important files, or even steal sensitive information just by walking in with that key. This SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4, and 11.5 on Windows, Linux, and Kubernetes, allowing attackers to run any SQL commands through specific Feature Service operations, bypassing authentication entirely.
An attacker exploiting this vulnerability could gain unauthorized access to your Enterprise Geodatabase, leading to potentially devastating data losses. They might modify crucial information or even delete entire datasets, disrupting operations and compromising data integrity. Immediately patch your ArcGIS Server to the latest version. Ensure you're running at least 11.6 or newer to eliminate this vulnerability. Additionally, review access controls to limit exposure to sensitive database operations. This is fixable! Follow these steps and your database will be more secure than ever. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| esri/arcgis_server | ≥ 11.3, ≤ 11.5 | — |