CVE-2025-67707: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2025-67707 is an unrestricted file upload vulnerability (CWE-434) in Esri ArcGIS Server versions 11.5 and earlier on both Windows and Linux platforms. It allows a remote, unauthenticated attacker to upload arbitrary files to the server's designated upload directories without proper file validation. The vulnerability was published on December 31, 2025, and a patch was made available via Esri's Security 2025 Update 2. It carries a CVSS v3.1 base score of 5.6 (Medium), reflecting high attack complexity and low impact across confidentiality, integrity, and availability (Esri Advisory, ENISA EUVD).

The root cause is insufficient validation of uploaded files (CWE-434: Unrestricted Upload of File with Dangerous Type), allowing attackers to submit arbitrary file types to ArcGIS Server's upload endpoints without authentication. Exploitation requires high attack complexity, as race conditions, secret values, or man-in-the-middle conditions must be present. Importantly, the server's architecture restricts uploaded files to non-executable storage locations and prevents modification of existing application components or system configurations, meaning uploaded files cannot be directly executed or used to escalate privileges. Affected versions span ArcGIS Server 10.9.1 through 11.5 (Esri Advisory, ENISA EUVD).

Successful exploitation allows remote unauthenticated attackers to upload arbitrary files to designated upload directories on affected ArcGIS Server instances. Due to architectural controls, uploaded files are confined to non-executable storage locations and cannot be used to execute code, escalate privileges, access sensitive data, or disrupt services directly. The vendor assesses the impact on confidentiality, integrity, and availability as low, and notes that exploitation requires additional conditions such as race conditions or man-in-the-middle scenarios (Esri Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.0014 (0.14%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, including race conditions, secret values, or man-in-the-middle conditions, which further limits practical exploitability (Esri Advisory, ENISA EUVD).

Esri has released a patch addressing this vulnerability as part of the ArcGIS Server Security 2025 Update 2. Organizations should upgrade ArcGIS Server to a version newer than 11.5 that includes this patch. As interim measures, administrators should implement network-level access controls to restrict file upload functionality to trusted sources, monitor upload activity for suspicious file types, and consider disabling file upload features if not operationally required (Esri Advisory).