CVE-2026-9181: 
ArcGIS Server vulnerability analysis and mitigation

CVE-2026-9181 is a directory traversal vulnerability (CWE-22) in Esri ArcGIS Server that allows unauthenticated remote attackers to access or overwrite sensitive files on the system by sending crafted path parameters. It affects all versions of ArcGIS Server on Windows and Linux up to and including version 12.0; ArcGIS Enterprise on Kubernetes is not impacted. The vulnerability was published on July 6, 2026, with a patch referenced in Esri's May 2026 ArcGIS Security Bulletin. The CVSS v3.1 base score is reported as 9.8 (Critical) by GitHub Advisory Database and ENISA EUVD, though NVD scores it at 7.5 (High) — the discrepancy reflects differing assessments of integrity and availability impact (GitHub Advisory, Esri Blog).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). An unauthenticated attacker can exploit this by sending HTTP requests with specially crafted path parameters containing directory traversal sequences (e.g., ../ or URL-encoded equivalents), causing the server to resolve file paths outside the intended restricted directory. Relevant attack patterns include CAPEC-126 (Path Traversal), CAPEC-64 (Using Slashes and URL Encoding to Bypass Validation), and CAPEC-78/79 (Using Escaped/Alternate Encoding of Slashes). Successful exploitation requires no authentication, no user interaction, and no special privileges, making it trivially automatable over the network (GitHub Advisory, Esri Blog).

Successful exploitation can allow an unauthenticated attacker to read sensitive files on the ArcGIS Server host system, and in more severe scenarios, overwrite sensitive files — potentially enabling full administrative access to ArcGIS Server. This results in high impact to confidentiality, and depending on exploitation depth, high impact to integrity and availability as well. Affected deployments include all ArcGIS Server instances on Windows and Linux running version 12.0 or earlier, which may expose geospatial data, configuration files, credentials, and other sensitive server-side resources (GitHub Advisory, Esri Blog).

1. Reconnaissance: Identify internet-facing ArcGIS Server instances (version 12.0 or earlier) using tools like Shodan, Censys, or Fofa by searching for ArcGIS Server banners or known service endpoints.
2. Identify vulnerable endpoints: Locate ArcGIS Server REST or web service endpoints that accept path parameters, such as those used for map services, feature services, or administrative APIs.
3. Craft traversal payload: Construct HTTP requests with path traversal sequences in the path parameters (e.g., ../../etc/passwd on Linux or ..\..\Windows\System32\drivers\etc\hosts on Windows), using URL encoding or alternate slash encodings to bypass basic input filters.
4. Send crafted request: Submit the malicious request to the ArcGIS Server endpoint without any authentication credentials.
5. Access or overwrite sensitive files: If the server fails to sanitize the path, it will resolve the traversal sequence and return the contents of the targeted file, or allow overwriting it — potentially enabling privilege escalation or full administrative access to ArcGIS Server (GitHub Advisory, Esri Blog).

• Network: Unusual HTTP requests to ArcGIS Server endpoints containing path traversal sequences such as ../, ..%2F, ..%5C, or double-encoded variants (%252F) in URL path parameters; unexpected outbound connections from the ArcGIS Server host.
• Logs: ArcGIS Server access logs showing requests with traversal patterns in path parameters; HTTP 200 responses to requests targeting files outside the web root (e.g., /etc/passwd, win.ini, configuration files); repeated requests from a single IP to service endpoints with varying path parameters.
• File System: Unexpected modification timestamps on sensitive system files (e.g., /etc/passwd, ArcGIS configuration files); new or altered files in the ArcGIS Server installation directory that were not part of a legitimate update.
• Process: Unusual child processes spawned by the ArcGIS Server process; unexpected administrative actions or configuration changes in ArcGIS Server Manager following suspicious HTTP activity (Esri Blog, Emerging Threats).

Esri has released a patch addressing this vulnerability, referenced in the May 2026 ArcGIS Security Bulletin; administrators should upgrade ArcGIS Server to a version newer than 12.0 as the primary remediation (Esri Blog). As interim workarounds, organizations should implement network segmentation to restrict ArcGIS Server access to trusted networks only, and apply web application firewall (WAF) rules to block requests containing path traversal sequences. Administrators should also review access logs to determine whether exploitation has already occurred, and consider disabling or restricting public-facing ArcGIS Server endpoints until patching is complete.

The vulnerability received coverage in The Hacker News' ThreatsDay roundup and was noted by security news outlets including SecurityOnline and CyberSecurityBoard (The Hacker News). A notable observation from deafnews.it highlighted the CVSS score discrepancy — the vulnerability was initially scored at 7.5 (High) by NVD but jumped to 9.8 (Critical) within two days, raising concerns about scoring consistency (deafnews.it). Horizon3.ai published attack research on the vulnerability, and CISA included it in its weekly vulnerability bulletin (SB26-194), indicating government-level awareness (CISA Bulletin).