CVE-2026-33522: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2026-33522 is an improper authorization vulnerability in Esri ArcGIS Server that allows a remote, unauthenticated attacker to update service metadata. It affects ArcGIS Server versions 11.3 up to (but not including) 12.0. The vulnerability was published on October 26, 2026, with patches available for versions 11.3, 11.5, and 12.0. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is classified as CWE-285 (Improper Authorization), meaning the application fails to correctly enforce authorization checks when an actor attempts to perform a privileged action — in this case, updating service metadata. An unauthenticated remote attacker can exploit this over the network with low attack complexity, requiring no user interaction or special privileges. The vulnerability is automatable, meaning it can be exploited programmatically at scale against exposed ArcGIS Server instances (Github Advisory).

Successful exploitation allows an unauthenticated attacker to tamper with service metadata on affected ArcGIS Server instances, resulting in a low integrity impact with no confidentiality or availability impact. This could enable an attacker to alter how services are described or discovered, potentially misleading clients or disrupting GIS workflows that rely on accurate service metadata. The scope is limited to the affected component, and there is no evidence of data exfiltration or service disruption capability through this vulnerability alone (Github Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the absence of active exploitation, the attack is automatable and requires no authentication, making it a low-barrier target if exposed to the internet (Github Advisory).

Esri has released patches for ArcGIS Server versions in General Availability and Extended support status: versions 11.3, 11.5, and 12.0. Administrators should apply the available patch immediately for these supported versions. Users running versions in mature or retired status (i.e., versions outside the 11.3–12.0 range) are not eligible for patches and should upgrade to a supported version before applying the patch. As an interim measure, implementing network-level access controls to restrict unauthenticated external access to ArcGIS Server endpoints is recommended (Github Advisory, Esri Security Bulletin).