CVE-2025-67705: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2025-67705 is a stored cross-site scripting (XSS) vulnerability in Esri ArcGIS Server 11.4 and earlier (including versions 10.9.1 through 11.4) on both Windows and Linux platforms. In certain configurations, a remote unauthenticated attacker can store files containing malicious code that may execute in the context of a victim's browser. The vulnerability was published on December 31, 2025, and a patch was made available via the ArcGIS Server Security 2025 Update 2 patch. It carries a CVSS v3.1 base score of 6.1 (Medium) (Esri Advisory, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) XSS variant. In certain ArcGIS Server configurations, the application fails to properly sanitize or restrict file uploads from unauthenticated users, allowing an attacker to store files containing malicious JavaScript or HTML on the server. When a victim subsequently accesses the affected server resource, the stored malicious code is served and executes within the victim's browser context. No privileges are required for exploitation, but user interaction (a victim visiting the compromised page) is necessary (Esri Advisory, ENISA EUVD).

Successful exploitation allows persistent malicious scripts to execute in the browsers of any user who visits the affected ArcGIS Server resource, enabling session hijacking, credential theft, data exfiltration, and redirection to malicious sites. Because the malicious content is stored server-side, multiple users can be affected without repeated attacker interaction. The vulnerability has a changed scope (S:C), meaning the impact extends beyond the vulnerable component to the victim's browser environment, with low confidentiality and integrity impacts and no direct availability impact (ENISA EUVD, Esri Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (ENISA EUVD). The EPSS score is approximately 0.04%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing ArcGIS Server instances running version 11.4 or earlier using tools like Shodan or Censys, or by directly probing known ArcGIS Server URL patterns.
2. Identify vulnerable configuration: Determine if the target server is configured in a way that permits unauthenticated file uploads or storage to a web-accessible location (the vulnerability is configuration-dependent).
3. Craft malicious file: Prepare a file (e.g., an HTML or SVG file) containing a malicious JavaScript payload, such as a cookie-stealing script or a redirect to a phishing page.
4. Upload/store the malicious file: Submit the crafted file to the ArcGIS Server via the vulnerable unauthenticated file storage mechanism.
5. Deliver the link to victims: Share or embed a URL pointing to the stored malicious file on the ArcGIS Server with targeted users (e.g., via phishing email or by embedding in a map service).
6. Payload execution: When a victim visits the URL, the stored malicious script executes in their browser context, enabling session token theft, credential harvesting, or further attacks (Esri Advisory, ENISA EUVD).

• Network: Unexpected HTTP POST or PUT requests from unauthenticated sources to ArcGIS Server file upload or storage endpoints; outbound connections from the server to unknown external IPs following user access to stored resources.
• File System: Presence of unexpected HTML, SVG, JavaScript, or other web-renderable files in ArcGIS Server web-accessible directories that were not placed there by administrators.
• Logs: ArcGIS Server access logs showing unauthenticated file upload requests; repeated access to newly created or unfamiliar file paths by multiple different users.
• Process/Browser: User reports of unexpected redirects, pop-ups, or authentication prompts when accessing ArcGIS Server resources.

Esri has released the ArcGIS Server Security 2025 Update 2 patch, which addresses this vulnerability for affected versions (10.9.1 through 11.4). Organizations should apply this patch immediately, prioritizing servers exposed to untrusted networks or the internet. As interim mitigations, implement network access controls to restrict who can reach ArcGIS Server instances, and monitor server logs for suspicious file upload or storage activity. Users should also be trained to avoid clicking suspicious links or uploading untrusted files to the server (Esri Advisory).