CVE-2026-10757

The record

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

Affected packages

Related vulnerabilities

• CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. CWE-89
• CVE-2026-62849 ThingLinks is an enterprise IoT platform. CWE-89
• CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. CWE-89
• CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. CWE-89
• CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-89
• CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for… CWE-89
• CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection… CWE-89
• CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the… CWE-89