Stored XSS in Esri ArcGIS Server 11.4 Enables Remote Code Execution

Publication date: 2025-12-31

Last updated on: 2025-12-31

Assigner: Environmental Systems Research Institute, Inc.

Description

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-31

Last Modified

2025-12-31

Generated

2026-07-06

AI Q&A

2026-01-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-67703

Affected Vendors & Products

Vendor	Product	Version / Range
esri	arcgis_server	11.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. It allows a remote unauthenticated attacker, under certain configurations, to store files containing malicious code that can execute in the context of a victim's browser.

Impact Analysis

The vulnerability can impact you by allowing attackers to execute malicious scripts in the browsers of users who access the affected server. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the victim's browser privileges.

Hi! I’m here to help you understand CVE-2025-67703. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70