CVE-2026-2813
Open Redirect Vulnerability in ArcGIS Server
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Environmental Systems Research Institute, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| esri | arcgis_server | 11.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability results in a limited confidentiality impact under specific user interaction conditions by redirecting the browser to an unintended, untrusted site. However, it affects only client side navigation logic during authentication and does not involve server side compromise or cross component impact.
Given the limited confidentiality impact and the confinement within the same security boundary, this vulnerability may have minimal direct effect on compliance with common standards and regulations such as GDPR or HIPAA, which emphasize protection of sensitive data and system integrity.
Nevertheless, any confidentiality impact, even limited, could potentially raise concerns under these regulations depending on the context of data handled and the environment in which ArcGIS Server is deployed.
Can you explain this vulnerability to me?
This vulnerability exists in ArcGIS Server 11.5 and involves an input validation weakness in the login redirection workflow.
An authenticated attacker can exploit this by sending a specially crafted request that causes the application to redirect the browser to an unintended and untrusted site.
The issue affects only the client side navigation logic during authentication and does not compromise the server or other components.
How can this vulnerability impact me? :
Successful exploitation may lead to the application redirecting users to untrusted sites, which could potentially expose users to phishing or other malicious activities.
The impact is limited to confidentiality under specific user interaction conditions, with no impact on integrity or availability.
Since the vulnerability is confined to client side navigation and remains within the same security boundary, no server side compromise or broader system impact is possible.