Esri ArcGIS: The Critical Vulnerability Wave Hitting the World's Maps

Esri ArcGIS: The Critical Vulnerability Wave Hitting the World's Maps

ArcGIS is the software behind most of the world's maps that you never see. Disaster response routing, urban planning, power-grid layouts, census data, defense logistics — all of it runs through Esri's platform inside governments and enterprises. It is trusted infrastructure doing unglamorous work, exposed on the edge of public networks the way a web app might be.

That trust is exactly what makes the past year uncomfortable. Esri shipped a wave of critical-to-serious CVEs across ArcGIS Server and Portal for ArcGIS — SQL injection, hardcoded credentials, server-side request forgery (SSRF), missing authentication, directory traversal, and unrestricted file upload — while a Chinese state-sponsored APT spent a year living inside an ArcGIS deployment it turned into a backdoor. If you run ArcGIS, this is the landscape you are actually in.

Why ArcGIS is a high-value target

ArcGIS is not a consumer tool, so it does not get the security attention of an operating system or a cloud console. But the platform is everywhere that matters. It stores the digital twin of national infrastructure: water, power, transport, telecom, emergency services. Esri's own compromise guidance lists power grids, network maps, population records, and infrastructure layouts as the sensitive data the platform holds.

Wrong guy gets into that and you are not losing a database of user emails. You are losing a detailed map of a country's critical infrastructure, and an APT with that data is a step ahead of the engineers still trying to defend it.

The critical CVEs, one after another

Esri's disclosure cadence has been relentless. Here are the headline findings from 2025 into 2026. The common thread is uncomfortable: several are remotely exploitable with no authentication, on the platform's default internet-facing configuration.

CVE-2025-57870 — SQL injection in ArcGIS Server Feature Services (CVSS 10.0)

The standout. A SQL injection vulnerability in specific ArcGIS Server Feature Service operations (versions 11.3–11.5 on Windows, Linux and Kubernetes) lets a remote, unauthenticated attacker execute arbitrary SQL commands against the underlying Enterprise Geodatabase.

This is as bad as it reads. It is CWE-89 — user input concatenated into SQL queries without sanitization. The CVSS vector is a straight 10.0: network attack, low complexity, no privileges, no user interaction, scope changed (impact crosses the trust boundary into the database), and full confidentiality, integrity and availability impact. In environments where the geodatabase account has elevated privileges, the injection can escalate to operating-system command execution via database features like SQL Server's xp_cmdshell.

Potential outcome: dump the geodatabase, delete it, or write arbitrary data into every map layer the organization trusts. ArcGIS versions with mature or retired support status should be assumed vulnerable, per Esri's advisory guidance.

CVE-2025-2538 — hardcoded credentials in Portal for ArcGIS (CVSS 9.8)

A specific deployment pattern of Portal for ArcGIS (11.4 and below) shipped with a hardcoded credential that could let a remote, unauthenticated attacker gain administrative access to the system. Hardcoded credentials are a gift to anyone who can reach the endpoint — they do not need to break anything, they just need to find the door.

CVE-2025-4967 — SSRF bypass in Portal for ArcGIS (CVSS 9.1)

A server-side request forgery protection bypass in Portal for ArcGIS 11.4 and prior. A remote, unauthenticated attacker can make the Portal issue requests to internal resources it should not reach. SSRF on an infrastructure platform is a classic pivot: reach metadata endpoints, hit internal ports, and move laterally from a single request.

CVE-2026-9181 and CVE-2026-9182 — directory traversal + unrestricted file upload in ArcGIS Server (CVSS 9.8 each)

Announced in the May 2026 ArcGIS security bulletin, both affect all versions of ArcGIS Server on Windows and Linux through 12.0 (not the Kubernetes flavor):

• CVE-2026-9181 — a directory traversal that lets an unauthenticated attacker overwrite sensitive files on the system via crafted path parameters. Esri's own advisory says abuse of this issue "can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability."
• CVE-2026-9182 — an unrestricted file upload where an unauthenticated attacker can upload arbitrary files and build on them. Classic CWE-434, the same weakness behind web-shell takeovers for two decades.

A pair of 9.8s that chain: traverse to where you can write, upload a web shell or overwrite config, and the server is yours.

CVE-2026-13019 — missing authentication in Portal for ArcGIS (CVSS 9.8)

An unprotected API in Portal for ArcGIS 12.1 and earlier exposed a critical function with no authentication. A remote, unauthenticated attacker can access it directly. Missing-authentication-on-critical-function is a bug class that should never exist in new code, yet it keeps showing up.

CVE-2026-13020 — weak password recovery in Portal for ArcGIS (CVSS 8.1)

A weak password-recovery mechanism in Portal for ArcGIS 12.1 and earlier lets a remote, unauthorized attacker assume ownership of a user's account by manipulating the recovery flow. This one does not even need a technical exploit — it abuses the account-recovery feature itself.

The pattern to be nervous about

Put the list together and a shape emerges. These are not obscure parser bugs needing a local file. Repeatedly it is unauthenticated remote exploitation against the internet-facing surface of a platform whose users assume it is trusted internal software. The severity is clustering at 9.8 and 10.0 because each one crosses a trust boundary — from the web tier into the geodatabase, or from a request into the operating system.

The other pattern is lifecycle. ArcGIS versions in "mature" or "retired" support status are explicitly told to be assumed vulnerable. GIS installations are notoriously long-lived — a city or a utility may keep an ArcGIS 10.x box running for a decade because re-platforming is expensive. Those installations are now sitting on known, patchless criticals.

The Flax Typhoon case: not a hypothetical

This is not theory. In October 2025, ReliaQuest published research on how attackers it attributes with high confidence to Chinese APTs — and with moderate confidence to Flax Typhoon (aka Ethereal Panda) — maintained more than a year of access to an organization's ArcGIS deployment.

The chain is the clever part, and it is why it matters. The attackers compromised a public-facing ArcGIS Server that was connected to a private, internal ArcGIS Server for backend computation — a common default configuration. Then they modified ArcGIS's Java server object extension (SOE) into a functioning web shell. They gated access with a hardcoded key for exclusive control, and they embedded the compromised component in the organization's own system backups — turning the recovery plan into a guaranteed method of reinfection.

Once inside, the attackers sent a malicious GET request with a base64-encoded payload in the layer parameter, which decoded to a cmd.exe command creating a hidden system directory. That quiet foothold gave the group hands-on-keyboard command execution, lateral movement and credential harvesting across multiple hosts, aided by a renamed SoftEther VPN bridge for encrypted command-and-control.

Bluntly: the original entry point is unknown — data retention obscured it, so even the investigators could not establish how the attackers first got in. What they did find was a compromised portal administrator account whose password had been reset to an attacker-style "leet" password of unknown origin. After joint analysis with Esri, ReliaQuest discounted a product vulnerability. The lesson is that the platform's trustworthiness became the attack — attackers repurposed a legitimate, whitelisted component so it would sail past defenses that assume trusted software behaves.

What to do about it

The two tracks are the software and the thinking.

Harden the software.

• Patch. Apply the current ArcGIS Server and Portal for ArcGIS security patches from the Esri Trust Center — this wave (SQLi, traversal, upload, missing auth) is fixed in patched builds. Unsupported "mature/retired" versions have no fix coming; plan an upgrade.
• Do not expose management interfaces to the internet. Block ArcGIS Server and Portal management/admin endpoints and the Service Directory unless deliberately published, and put the platform behind a proper WAF rule set rather than assuming default isolation.
• Network-segment the web tier from the geodatabase. If the front-end is compromised, the database should not be a single hop away.
• Apply the minimal-file-system-permission principle so a traversal or upload cannot overwrite configuration or land a web shell.
• Harden the weak password recovery and enforce strong, unique administrator credentials with MFA. The attackers operated with a compromised portal administrator account.

Change the thinking.

• Treat every public-facing application — including "trusted old GIS software" — as a high-risk asset with backend reach. The ReliaQuest researchers called the ArcGIS case a wake-up call for this exact reason.
• Assume legitimate components can become backdoors. That requires behavioral detection, not just IOC and signature matching, because the payloads here were disguised base64 strings and a repurposed native extension — nothing that looks like malware.
• Treat your disaster-recovery backups as a possible reinfection vector. If an attacker embeds their backdoor in your backups, restoring from them reinstates them. Validate backups are clean, not just assumed to be.

ArcGIS is a cornerstone of how states and enterprises see the world. It is also, right now, a platform that shipped six critical vulnerabilities in a single cycle and a confirmed real-world, year-long APT foothold. The maps we trust deserve the same security rigor as the networks we connect. They are not getting it by default — that part is on the people who run them.

Sources:

• Esri — ArcGIS Server Feature Services Security Patch (CVE-2025-57870)
• NVD — CVE-2025-57870 (SQL injection, CVSS 10.0)
• NVD — CVE-2025-2538 (hardcoded credentials, CVSS 9.8)
• NVD — CVE-2025-4967 (SSRF bypass, CVSS 9.1)
• OpenCVE — CVE-2026-9181 (directory traversal, CVSS 9.8)
• OpenCVE — CVE-2026-9182 (unrestricted file upload, CVSS 9.8)
• OpenCVE — CVE-2026-13019 and CVE-2026-13020 (missing auth / weak password recovery)
• ReliaQuest — Inside Flax Typhoon's ArcGIS Compromise
• The Hacker News — Chinese Hackers Exploit ArcGIS Server as Backdoor for Over a Year
• Dark Reading — China's Flax Typhoon Turns Geo-Mapping into Backdoor
• Esri — Understanding the ArcGIS Server SOE Compromise

Sources

• Esri: Esri — ArcGIS Server Feature Services Security Patch (CVE-2025-57870)
• NIST NVD: NVD — CVE-2025-57870 (SQL injection, CVSS 10.0)
• NIST NVD: NVD — CVE-2025-2538 (hardcoded credentials, CVSS 9.8)
• NIST NVD: NVD — CVE-2025-4967 (SSRF bypass, CVSS 9.1)
• OpenCVE: OpenCVE — CVE-2026-9181 (directory traversal, CVSS 9.8)
• OpenCVE: OpenCVE — CVE-2026-9182 (unrestricted file upload, CVSS 9.8)
• OpenCVE: OpenCVE — CVE-2026-13019 and CVE-2026-13020 (missing auth / weak password recovery)
• ReliaQuest: ReliaQuest — Inside Flax Typhoon's ArcGIS Compromise (14 Oct 2025)
• The Hacker News: The Hacker News — Chinese Hackers Exploit ArcGIS Server as Backdoor for Over a Year
• Dark Reading: Dark Reading — China's Flax Typhoon Turns Geo-Mapping into Backdoor
• Esri: Esri — Understanding the ArcGIS Server SOE Compromise