CVE-2026-2813Unvalidated Redirect in ArcGIS Server
Updated under an hour ago ()
Does this affect you?
It affects Esri ArcGIS Server. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions. The vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible. This issue affects ArcGIS Server 11.5.
- CVSS
- 4.7 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Esri
- NVD analysis
- Analyzed
- Record last updated
- May 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Esri ArcGIS Server esri:arcgis_server (from the name) | 11.5 | CNA record |
esri arcgis_server esri:arcgis_server | 11.5 | NVD |
References
- https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletinvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.