CVE-2026-33522
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Metadata Update in Esri ArcGIS Server

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Environmental Systems Research Institute, Inc.

Description
Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-33522
EUVD
EUVD-2026-110060

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Esri ArcGIS Server 11.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Esri ArcGIS Server versions 11.3 to 12.0 allows a remote, unauthenticated attacker to update service metadata without authorization. A patch is available for supported versions like 12.0, 11.5, and 11.3, but not for matured or retired versions.

Detection Guidance

Detection involves checking ArcGIS Server versions between 11.3 and 12.0. Verify installed version via command line or web interface. Look for unauthorized metadata updates in service logs.

Impact Analysis

An attacker could modify service metadata, potentially leading to misinformation, service disruption, or unauthorized changes in how the GIS server operates. This could affect data integrity and system reliability.

Mitigation Strategies

Apply the provided patch to ArcGIS Server versions 12.0, 11.5, or 11.3. Upgrade to a supported version if using 11.3 to 12.0. Block external access to service metadata endpoints if patching is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart