CVE-2026-33521: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2026-33521 is a denial-of-service vulnerability in Esri ArcGIS Server versions 12.0 and prior, classified as CWE-400 (Uncontrolled Resource Consumption). A remote, unauthenticated attacker can supply crafted requests that, under exceptional circumstances, exhaust all available worker threads and deny service to legitimate users. The vulnerability was published on October 26, 2026, with patches available for versions in General Availability and Extended support status (12.0, 11.5, 11.3, and 11.1). It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Esri Blog).

The root cause is uncontrolled resource consumption (CWE-400), where ArcGIS Server fails to properly limit or throttle the allocation of worker threads in response to specially crafted network requests. Attack patterns associated with this vulnerability include XML Ping of the Death (CAPEC-147) and Regular Expression Exponential Blowup (CAPEC-492), suggesting the crafted requests may exploit parsing or processing logic to trigger disproportionate resource usage. No authentication or user interaction is required, and the attack complexity is low, making it straightforward to trigger over the network. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory, Esri Blog).

Successful exploitation results in complete unavailability of the ArcGIS Server service, as all worker threads are consumed and legitimate requests cannot be processed. There is no impact to confidentiality or data integrity — the vulnerability is limited to availability. Organizations relying on ArcGIS Server for geospatial services, mapping, or GIS workflows would experience a full service outage until the server recovers or is restarted (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is automatable (no user interaction required) and exploitable by unauthenticated remote attackers, which lowers the barrier for potential abuse. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Esri Blog).

Esri has released patches for ArcGIS Server versions in General Availability and Extended support status: 12.0, 11.5, 11.3, and 11.1. Versions in mature or retired status are not eligible for patches; users on those versions should upgrade to a supported release and apply the patch. As a complementary measure, administrators should consider implementing rate limiting or request filtering at the network perimeter to reduce exposure to crafted requests (Esri Blog, GitHub Advisory).