CVE-2025-67710: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2025-67710 is a stored cross-site scripting (XSS) vulnerability in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In certain configurations, a remote unauthenticated attacker can store files containing malicious code that may execute in the context of a victim's browser. The vulnerability was published on December 31, 2025, and a patch was made available in January 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (Esri Advisory, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. In certain ArcGIS Server configurations, an unauthenticated remote attacker can upload or store files containing malicious JavaScript or other client-side code without proper input sanitization or output encoding. When a victim subsequently visits an affected page, the stored malicious code executes within their browser session. No authentication or elevated privileges are required by the attacker, though user interaction (victim visiting the page) is necessary for the payload to trigger (Esri Advisory, ENISA EUVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the ArcGIS Server web interface. This can lead to credential theft, session hijacking, unauthorized data access, or further malicious actions performed on behalf of the victim. The confidentiality and integrity impacts are rated low, and there is no direct availability impact; however, the scope is changed, meaning the impact can extend beyond the vulnerable component to the victim's browser environment (ENISA EUVD).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Esri Advisory, ENISA EUVD).

1. Reconnaissance: Identify internet-facing ArcGIS Server instances running version 11.4 or earlier using tools like Shodan or Censys, focusing on configurations that permit unauthenticated file uploads or storage.
2. Identify vulnerable endpoint: Locate ArcGIS Server endpoints or features that allow unauthenticated users to upload or store files (e.g., specific REST API endpoints or web application features enabled in certain configurations).
3. Craft malicious payload: Prepare a file containing a malicious JavaScript payload (e.g., a script that steals session cookies or redirects the victim to an attacker-controlled site).
4. Store the payload: Upload or submit the malicious file to the vulnerable ArcGIS Server endpoint without authentication, exploiting the lack of input sanitization.
5. Trigger execution: Wait for or socially engineer a victim (e.g., an ArcGIS Server administrator or user) to visit the page or resource where the malicious file is stored, causing the script to execute in their browser context.
6. Achieve objective: Harvest session tokens, credentials, or perform actions on behalf of the victim within the ArcGIS Server application (Esri Advisory).

• Network: Unexpected or anomalous HTTP POST/PUT requests to ArcGIS Server file upload or storage endpoints from unauthenticated sources; outbound connections from victim browsers to unknown external domains following ArcGIS Server page visits.
• Logs: ArcGIS Server access logs showing unauthenticated file upload requests containing script tags or encoded JavaScript payloads; repeated access to specific pages by different users shortly after a suspicious file upload event.
• File System: Presence of unexpected files with .html, .js, or other web-renderable extensions in ArcGIS Server upload or content directories containing <script> tags or obfuscated JavaScript.
• Browser/Application: Unexpected JavaScript execution errors or redirects reported by users accessing ArcGIS Server pages; session tokens appearing in external server logs not controlled by the organization.

Esri has released a security patch addressing this vulnerability, documented as the ArcGIS Server Security 2025 Update 2 Patch. Organizations running ArcGIS Server 11.4 and earlier on Windows or Linux should apply this patch as a priority. As interim mitigations, administrators should restrict unauthenticated file upload capabilities where possible, implement input validation and output encoding controls, and limit network access to ArcGIS Server endpoints to trusted users and IP ranges (Esri Advisory).

Coverage of CVE-2025-67710 has been limited to vulnerability tracking platforms and automated feeds, with no notable researcher commentary or significant media coverage identified. The vulnerability was noted in standard CVE tracking sources and ENISA's EUVD database shortly after disclosure (ENISA EUVD).