# Esri vulnerabilities Source: https://junglewise.ai/threats/vendors/esri Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/esri.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 40 vulnerabilities in Esri: 0 in the last 7 days and 22 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-50096, was published on 26 October 2026. 9 vulnerabilities in the last four weeks, up 800% on the four before (1). 2 critical against 0. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 22 - All time: 40 (7 critical, 0 exploited in the wild) ## About Esri A geographic information system software company specializing in mapping and spatial analysis tools. ## Latest Esri vulnerabilities - [CVE-2026-50096: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-50096-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri) (medium, CVSS 6.1, published 26 Oct 2026) - [CVE-2026-50095: Esri ArcGIS Server stored XSS in file uploads](https://junglewise.ai/threats/cve-2026-50095-there-is-a-stored-cross-site-scripting-issue-in-esri-arcgis) (medium, CVSS 6.1, published 26 Oct 2026) - [CVE-2026-33522: Esri ArcGIS Server unauthenticated service metadata update](https://junglewise.ai/threats/cve-2026-33522-esri-arcgis-server-versions-11-3-to-12-0-only-allows-a-remote) (medium, CVSS 5.3, published 26 Oct 2026) - [CVE-2026-33521: Esri ArcGIS Server denial of service in request handling](https://junglewise.ai/threats/cve-2026-33521-there-is-s-denial-of-service-vulnerability-in-esri-arcgis-server) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-33520: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-33520-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri) (medium, CVSS 6.1, published 26 Oct 2026) - [CVE-2026-10757: Esri ArcGIS Server SQL injection](https://junglewise.ai/threats/cve-2026-10757-there-is-a-sql-injection-vulnerability-in-esri-arcgis-server) (critical, CVSS 9.8, published 26 Oct 2026) - [CVE-2026-69227: Esri Portal for ArcGIS authentication bypass in admin API](https://junglewise.ai/threats/cve-2026-69227-a-flaw-in-portal-for-arcgis-allows-unauthenticated-access-to) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-69226: Esri Portal for ArcGIS account creation bypass in sharing endpoint](https://junglewise.ai/threats/cve-2026-69226-a-flaw-in-portal-for-arcgis-allows-unauthenticated-users-to) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-10759: Esri Portal for ArcGIS LDAP injection in administrative functionality](https://junglewise.ai/threats/cve-2026-10759-a-flaw-in-portal-for-arcgis-could-allow-ldap-injection-through) (medium, CVSS 5.5, published 13 Oct 2026) - [CVE-2026-10758: Esri LERC heap overflow via integer overflow in image encoding](https://junglewise.ai/threats/cve-2026-10758-esri-lerc-is-an-open-source-image-or-raster-format-which-supports) (high, CVSS 7.5, published 25 Sep 2026) - [CVE-2026-69238: Esri Portal for ArcGIS HTML injection](https://junglewise.ai/threats/cve-2026-69238-esri-portal-for-arcgis-html-injection) (low, CVSS 3.5, published 21 Aug 2026) - [CVE-2026-69237: Esri Portal for ArcGIS HTML injection in administrative API](https://junglewise.ai/threats/cve-2026-69237-esri-portal-for-arcgis-html-injection-in-administrative-api) (low, CVSS 3.8, published 21 Aug 2026) - [CVE-2026-69235: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69235-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 6.1, published 21 Aug 2026) - [CVE-2026-69234: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-69234-esri-portal-for-arcgis-reflected-cross-site-scripting) (medium, CVSS 6.1, published 21 Aug 2026) - [CVE-2026-69233: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69233-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 5.5, published 21 Aug 2026) - [CVE-2026-69232: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69232-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 5.5, published 21 Aug 2026) - [CVE-2026-69231: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69231-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 5.5, published 21 Aug 2026) - [CVE-2026-69230: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69230-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 5.5, published 21 Aug 2026) - [CVE-2026-69229: Esri Portal for ArcGIS HTML injection](https://junglewise.ai/threats/cve-2026-69229-esri-portal-for-arcgis-html-injection) (medium, CVSS 5.4, published 21 Aug 2026) - [CVE-2026-69228: Esri Portal for ArcGIS authentication bypass in resource access](https://junglewise.ai/threats/cve-2026-69228-esri-portal-for-arcgis-authentication-bypass-in-resource-access) (medium, CVSS 5.3, published 21 Aug 2026) - [CVE-2026-69225: Esri Portal for ArcGIS information disclosure via HTTP response reflection](https://junglewise.ai/threats/cve-2026-69225-esri-portal-for-arcgis-information-disclosure-via-http-response) (medium, CVSS 5.9, published 21 Aug 2026) - [CVE-2026-69224: Esri Portal for ArcGIS information disclosure in HTTP response](https://junglewise.ai/threats/cve-2026-69224-esri-portal-for-arcgis-information-disclosure-in-http-response) (medium, CVSS 5.9, published 21 Aug 2026) - [CVE-2026-13020: Esri Portal for ArcGIS weak password recovery mechanism](https://junglewise.ai/threats/cve-2026-13020-esri-portal-for-arcgis-weak-password-recovery-mechanism) (high, CVSS 8.1, published 7 Jul 2026) - [CVE-2026-13019: Esri Portal for ArcGIS missing authentication for critical function](https://junglewise.ai/threats/cve-2026-13019-esri-portal-for-arcgis-missing-authentication-for-critical) (critical, CVSS 9.8, published 7 Jul 2026) - [CVE-2026-9182: Esri ArcGIS Server unrestricted file upload](https://junglewise.ai/threats/cve-2026-9182-esri-arcgis-server-unrestricted-file-upload) (medium, CVSS 5.3, published 6 Jul 2026) ## Most severe Esri vulnerabilities - [CVE-2025-57870: A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and…](https://junglewise.ai/threats/cve-2025-57870-a-sql-injection-vulnerability-exists-in-esri-arcgis-server) (critical, CVSS 10, published 22 Oct 2025) - [CVE-2026-69227: Esri Portal for ArcGIS authentication bypass in admin API](https://junglewise.ai/threats/cve-2026-69227-a-flaw-in-portal-for-arcgis-allows-unauthenticated-access-to) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-33519: Esri Portal for ArcGIS incorrect authorization in developer credentials](https://junglewise.ai/threats/cve-2026-33519-esri-portal-for-arcgis-incorrect-authorization-in-developer) (critical, CVSS 9.8, published 21 Apr 2026) - [CVE-2026-33518: Esri Portal for ArcGIS incorrect privilege assignment](https://junglewise.ai/threats/cve-2026-33518-esri-portal-for-arcgis-incorrect-privilege-assignment) (critical, CVSS 9.8, published 21 Apr 2026) - [CVE-2026-10757: Esri ArcGIS Server SQL injection](https://junglewise.ai/threats/cve-2026-10757-there-is-a-sql-injection-vulnerability-in-esri-arcgis-server) (critical, CVSS 9.8, published 26 Oct 2026) - [CVE-2026-13019: Esri Portal for ArcGIS missing authentication for critical function](https://junglewise.ai/threats/cve-2026-13019-esri-portal-for-arcgis-missing-authentication-for-critical) (critical, CVSS 9.8, published 7 Jul 2026) - [CVE-2026-9181: Esri ArcGIS Server directory traversal](https://junglewise.ai/threats/cve-2026-9181-esri-arcgis-server-directory-traversal) (critical, CVSS 9.8, published 6 Jul 2026) - [CVE-2026-13020: Esri Portal for ArcGIS weak password recovery mechanism](https://junglewise.ai/threats/cve-2026-13020-esri-portal-for-arcgis-weak-password-recovery-mechanism) (high, CVSS 8.1, published 7 Jul 2026) - [CVE-2026-33521: Esri ArcGIS Server denial of service in request handling](https://junglewise.ai/threats/cve-2026-33521-there-is-s-denial-of-service-vulnerability-in-esri-arcgis-server) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-10758: Esri LERC heap overflow via integer overflow in image encoding](https://junglewise.ai/threats/cve-2026-10758-esri-lerc-is-an-open-source-image-or-raster-format-which-supports) (high, CVSS 7.5, published 25 Sep 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 800% on the four before (1). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 12 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 6 | 1 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Esri technologies - [Esri Portal-For-Arcgis](https://junglewise.ai/threats/technologies/portal-for-arcgis): 21 vulnerabilities - [Esri ArcGIS Server](https://junglewise.ai/threats/technologies/arcgis-server): 18 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Esri vulnerabilities", https://junglewise.ai/threats/vendors/esri, 13 November 2026.