Quick answers
- Is CVE-2026-33521 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33521 being exploited in the wild.
- How severe is CVE-2026-33521?
- High severity, with a CVSS score of 7.5, published 26 October 2026.
- Which products and versions are affected?
- Esri ArcGIS Server 12.0 and prior.
- Is there a fix for CVE-2026-33521?
- Yes: fixed in ArcGIS Server 12.0, 11.5, 11.3, 11.1 (patched versions). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33521 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-33521?
- Check whether you run Esri ArcGIS Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: ArcGIS Server 12.0, 11.5, 11.3, 11.1 (patched versions)
Technical details
A denial-of-service vulnerability in ArcGIS Server versions 12.0 and earlier allows remote, unauthenticated attackers to exhaust available worker threads through crafted requests, denying service to legitimate users. The vulnerability can be triggered over the network without authentication or user interaction, though exploitation requires exceptional circumstances. Patches are available for versions 12.0, 11.5, 11.3, and 11.1.
Affected products
- Esri ArcGIS Server 12.0 and prior
Timeline
- 2026-10-26: disclosed