Vulnerability-Lookup

WID-SEC-W-2026-1627

Vulnerability from csaf_certbund - Published: 2026-05-20 22:00 - Updated: 2026-05-20 22:00

Summary

ESRI ArcGIS: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: ArcGIS ist ein Geoinformationssystem.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.

Betroffene Betriebssysteme: - Sonstiges - Windows

CVE-2026-2812

Affected products

Known affected 6 products

Product	Identifier	Version
ESRI ArcGIS Server 11.5 ESRI / ArcGIS	`cpe:/a:esri:arcgis:server_11.5`	Server 11.5
ESRI ArcGIS Server 11.4 ESRI / ArcGIS	`cpe:/a:esri:arcgis:server_11.4`	Server 11.4
ESRI ArcGIS Server 11.3 ESRI / ArcGIS	`cpe:/a:esri:arcgis:server_11.3`	Server 11.3
ESRI ArcGIS Server 11.2 ESRI / ArcGIS	`cpe:/a:esri:arcgis:server_11.2`	Server 11.2
ESRI ArcGIS Server 11.1 ESRI / ArcGIS	`cpe:/a:esri:arcgis:server_11.1`	Server 11.1
ESRI ArcGIS Server 12.0 ESRI / ArcGIS	`cpe:/a:esri:arcgis:server_12.0`	Server 12.0

CVE-2026-2813

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
ESRI ArcGIS Server 11.5 ESRI / ArcGIS	`cpe:/a:esri:arcgis:server_11.5`	Server 11.5

References

5 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/advisories/GHSA-3wjj-6pp2-788h	external
https://github.com/advisories/GHSA-48M7-R7VC-4M4F	external
https://www.esri.com/arcgis-blog/products/trust-a…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "ArcGIS ist ein Geoinformationssystem.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1627 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1627.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1627 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1627"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-3wjj-6pp2-788h vom 2026-05-20",
        "url": "https://github.com/advisories/GHSA-3wjj-6pp2-788h"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-3wjj-6pp2-788h vom 2026-05-20",
        "url": "https://github.com/advisories/GHSA-48M7-R7VC-4M4F"
      },
      {
        "category": "external",
        "summary": "ArcGIS Server Security 2026 Update 1 Patch vom 2026-05-20",
        "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin"
      }
    ],
    "source_lang": "en-US",
    "title": "ESRI ArcGIS: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-20T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-21T11:00:37.117+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1627",
      "initial_release_date": "2026-05-20T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-20T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Server 11.5",
                "product": {
                  "name": "ESRI ArcGIS Server 11.5",
                  "product_id": "T054431",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:esri:arcgis:server_11.5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Server 11.1",
                "product": {
                  "name": "ESRI ArcGIS Server 11.1",
                  "product_id": "T054433",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:esri:arcgis:server_11.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Server 11.2",
                "product": {
                  "name": "ESRI ArcGIS Server 11.2",
                  "product_id": "T054435",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:esri:arcgis:server_11.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Server 11.3",
                "product": {
                  "name": "ESRI ArcGIS Server 11.3",
                  "product_id": "T054437",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:esri:arcgis:server_11.3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Server 11.4",
                "product": {
                  "name": "ESRI ArcGIS Server 11.4",
                  "product_id": "T054439",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:esri:arcgis:server_11.4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Server 12.0",
                "product": {
                  "name": "ESRI ArcGIS Server 12.0",
                  "product_id": "T054444",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:esri:arcgis:server_12.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ArcGIS"
          }
        ],
        "category": "vendor",
        "name": "ESRI"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-2812",
      "product_status": {
        "known_affected": [
          "T054431",
          "T054439",
          "T054437",
          "T054435",
          "T054433",
          "T054444"
        ]
      },
      "release_date": "2026-05-20T22:00:00.000+00:00",
      "title": "CVE-2026-2812"
    },
    {
      "cve": "CVE-2026-2813",
      "product_status": {
        "known_affected": [
          "T054431"
        ]
      },
      "release_date": "2026-05-20T22:00:00.000+00:00",
      "title": "CVE-2026-2813"
    }
  ]
}

CVE-2026-2812 (GCVE-0-2026-2812)

Vulnerability from cvelistv5 – Published: 2026-05-20 17:47 – Updated: 2026-05-20 19:30

Title

Improper Authentication issue in ArcGIS Server

Summary

ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-287 - Improper Authentication

Assigner

Esri

References

1 reference

URL	Tags
https://www.esri.com/arcgis-blog/products/trust-a…

Impacted products

1 product

Vendor	Product	Version
Esri	ArcGIS Server	Affected: 11.1 , ≤ 12.0 (custom)

Date Public

2026-05-06 17:47

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2812",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T19:30:27.592167Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T19:30:36.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "ArcGIS Server",
          "vendor": "Esri",
          "versions": [
            {
              "lessThanOrEqual": "12.0",
              "status": "affected",
              "version": "11.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-06T17:47:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier."
            }
          ],
          "value": "ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-20T17:47:40.451Z",
        "orgId": "cedc17bb-4939-4f40-a1f4-30ae8af1094e",
        "shortName": "Esri"
      },
      "references": [
        {
          "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin"
        }
      ],
      "source": {
        "defect": [
          "BUG-000182852"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Improper Authentication issue in ArcGIS Server",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cedc17bb-4939-4f40-a1f4-30ae8af1094e",
    "assignerShortName": "Esri",
    "cveId": "CVE-2026-2812",
    "datePublished": "2026-05-20T17:47:40.451Z",
    "dateReserved": "2026-02-19T16:37:22.095Z",
    "dateUpdated": "2026-05-20T19:30:36.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2813 (GCVE-0-2026-2813)

Vulnerability from cvelistv5 – Published: 2026-05-20 17:51 – Updated: 2026-05-20 19:29

Title

Unvalidated Redirect in ArcGIS Server

Summary

ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions. The vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible. This issue affects ArcGIS Server 11.5.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE‑601: URL Redirection to Untrusted Site (Open Redirect)

Assigner

Esri

References

1 reference

URL	Tags
https://www.esri.com/arcgis-blog/products/trust-a…

Impacted products

1 product

Vendor	Product	Version
Esri	ArcGIS Server	Affected: 11.5

Date Public

2026-05-06 17:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2813",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T19:29:14.354676Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T19:29:23.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "ArcGIS Server",
          "vendor": "Esri",
          "versions": [
            {
              "status": "affected",
              "version": "11.5"
            }
          ]
        }
      ],
      "datePublic": "2026-05-06T17:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003eArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions.\u003cbr\u003eThe vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible.\u0026nbsp;\u0026nbsp;This issue affects ArcGIS Server 11.5.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions.\nThe vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible.\u00a0\u00a0This issue affects ArcGIS Server 11.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE\u2011601: URL Redirection to Untrusted Site (Open Redirect)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-20T17:51:51.061Z",
        "orgId": "cedc17bb-4939-4f40-a1f4-30ae8af1094e",
        "shortName": "Esri"
      },
      "references": [
        {
          "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin"
        }
      ],
      "source": {
        "defect": [
          "BUG-000181143"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Unvalidated Redirect in ArcGIS Server",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cedc17bb-4939-4f40-a1f4-30ae8af1094e",
    "assignerShortName": "Esri",
    "cveId": "CVE-2026-2813",
    "datePublished": "2026-05-20T17:51:51.061Z",
    "dateReserved": "2026-02-19T16:37:23.274Z",
    "dateUpdated": "2026-05-20T19:29:23.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-1627

CVE-2026-2812 (GCVE-0-2026-2812)

CVE-2026-2813 (GCVE-0-2026-2813)

Tags

Sightings

Nomenclature