ESRI ArcGIS

Name: ESRI ArcGIS
Brand: ESRI

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

3critical9high40medium0low

updated 2026-10-28

vulnerabilities (108)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-25693US	critical9.9	1.26% (70th)	—	no fix	2024-04-04	3 versions
CVE-2026-9181US	high7.5	1.22% (69th)	—	Server Security 2026 Update 2	2026-07-06	< Server Security 2026 Update 2
CVE-2026-13019US	—	0.85% (58th)	—	2026 Update 2 Patch	2026-07-07	< 2026 Update 2 Patch
CVE-2024-25699US	high8.5	0.69% (53rd)	—	no fix	2024-04-04	3 versions
CVE-2024-38036US	—	0.63% (50th)	—	10.8.1	2024-10-04	4 versions
CVE-2026-9182US	—	0.62% (49th)	—	Server Security 2026 Update 2	2026-07-06	< Server Security 2026 Update 2
CVE-2024-51958US	—	0.61% (49th)	—	no fix	2025-03-03	≤ Server Security <2025 Update 1
CVE-2024-51966US	—	0.60% (48th)	—	no fix	2025-03-03	≤ Server Security <2025 Update 1
CVE-2025-4967US	—	0.58% (48th)	—	11.5	2025-05-29	2 versions
CVE-2025-2538US	—OT elevated	0.56% (47th)	—	no fix	2025-03-20	≤ Portal <Security 2025 Update 1 Patch
CVE-2025-57870US	—	0.54% (45th)	—	no fix	2025-10-22	3 versions
CVE-2024-51962US	high8.7	0.51% (43rd)	—	no fix	2025-03-03	≤ Server Security <2025 Update 1
CVE-2026-69228US	medium5.3OT elevated	0.48% (41st)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2024-38040US	high7.5	0.48% (41st)	—	10.8.1	2024-10-04	4 versions
CVE-2024-25690US	medium4.7	0.47% (40th)	—	no fix	2024-04-04	3 versions
CVE-2024-51961US	—	0.47% (40th)	—	no fix	2025-03-03	≤ Server Security <2025 Update 1
CVE-2026-13020US	critical9.8	0.47% (40th)	—	2026 Update 2 Patch	2026-07-07	< 2026 Update 2 Patch
CVE-2024-25705US	medium5.4	0.47% (40th)	—	no fix	2024-04-04	3 versions
CVE-2024-25695US	high7.2	0.46% (40th)	—	no fix	2024-04-04	3 versions
CVE-2026-69225US	high7.5	0.46% (39th)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2026-69224US	high7.5	0.46% (39th)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2024-25709US	medium6.1	0.45% (39th)	—	no fix	2024-04-04	3 versions
CVE-2026-33521US	high7.5	0.45% (39th)	—	2026 Update 3	2026-10-26	2 versions
CVE-2026-10757US	critical9.8	0.45% (38th)	—	2026 Update 3	2026-10-26	2 versions
CVE-2024-25706US	medium6.1	0.43% (37th)	—	no fix	2024-04-04	3 versions
CVE-2024-25698US	medium6.1	0.43% (37th)	—	no fix	2024-04-04	3 versions
CVE-2024-8149US	medium4.6	0.42% (36th)	—	11.2	2024-10-04	4 versions
CVE-2024-25697US	medium5.4	0.37% (31st)	—	no fix	2024-04-04	3 versions
CVE-2024-25708US	medium4.8	0.37% (31st)	—	no fix	2024-04-04	3 versions
CVE-2024-25696US	medium4.8	0.37% (31st)	—	no fix	2024-04-04	3 versions
CVE-2024-25700US	—	0.37% (31st)	—	no fix	2024-04-04	3 versions
CVE-2024-25707US	medium4.8	0.36% (29th)	—	10.8.1	2024-10-04	4 versions
CVE-2025-67706US	medium5.6	0.35% (29th)	—	no fix	2025-12-31	5 versions
CVE-2026-69234US	medium6.1	0.34% (28th)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2025-67712US	—	0.33% (26th)	—	no fix	2025-12-19	≤ Web App Builde <2.30
CVE-2024-38038US	medium6.1	0.33% (26th)	—	10.8.1	2024-10-04	4 versions
CVE-2024-25691US	medium6.1	0.33% (26th)	—	11.1	2024-10-04	4 versions
CVE-2026-69232US	medium5.5	0.33% (26th)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2026-69231US	medium5.5	0.33% (26th)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2024-8148US	medium6.1	0.32% (25th)	—	10.8.1	2024-10-04	4 versions
CVE-2024-38037US	medium6.1	0.32% (25th)	—	10.8.1	2024-10-04	4 versions
CVE-2024-51954US	high8.5	0.32% (24th)	—	no fix	2025-03-03	≤ Server Security <2025 Update 1
CVE-2026-69236US	medium6.1	0.30% (23rd)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2026-69235US	medium6.1	0.30% (23rd)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2025-67707US	medium5.6	0.30% (23rd)	—	no fix	2025-12-31	5 versions
CVE-2024-38039US	medium5.4	0.29% (21st)	—	10.8.1	2024-10-04	4 versions
CVE-2026-69237US	medium4.8	0.29% (21st)	—	no fix	2026-08-21	≤ Portal <2026 Security Update 3
CVE-2024-25702US	medium4.8	0.29% (21st)	—	10.8.1	2024-10-04	4 versions
CVE-2024-25701US	medium4.8	0.29% (21st)	—	10.8.1	2024-10-04	4 versions
CVE-2024-25694US	medium4.8	0.29% (21st)	—	10.8.1	2024-10-04	4 versions

showing 50 of 108

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')71 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')5 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type3 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')3 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-426Untrusted Search Path2 CVEs
CWE-640Weak Password Recovery Mechanism for Forgotten Password2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)108 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan