Esri ArcGIS Server: Denial of Service (CVE-2026-33521)
Esri ArcGIS Server versions 12.0 and prior contain a denial of service vulnerability that may allow a remote, unauthenticated attacker to exhaust worker threads.
CVE search metadata
CVE search record: CVE-2026-33521. Severity: high. CVSS: 7.5. KEV: no. Product: ArcGIS Server (<= 12.0). Brief: Esri ArcGIS Server: Denial of Service (CVE-2026-33521). Brief link: https://feed.craftedsignal.io/briefs/2026-10-arcgis-server-dos/
Triage facts
Revision 1- Applicability
- ArcGIS Server (<= 12.0)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 19:44 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A denial of service vulnerability exists in Esri ArcGIS Server versions 12.0 and prior. A remote, unauthenticated attacker may supply crafted requests that, under exceptional circumstances, consume all available worker threads and deny service to users.
Patches are provided for software in General Availability and Extended support status, including versions 11.1, 11.3, 11.5, and 12.0. Versions in mature or retired status are not patch eligible; users are advised to upgrade.