CVE-2026-33522
Medium
Description
Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
SeverityMedium
CVSS5.3
Exploit probability—
ProductArcGIS Server
PublishedOct 26, 2026
First seenOct 26, 2026
Weakness typeCWE-285CWE-285
How to fix
Update
- Esri ArcGIS Server12.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Esri ArcGIS Server | 11.3 ≤ v < 12.0 | 12.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.