Technical impact
An SQL injection flaw exists in Esri ArcGIS Server versions 12.1 and earlier. The vulnerability allows an attacker who can reach the ArcGIS Server service, either directly or through a publicly exposed configuration, to inject arbitrary SQL statements into the database query stream. This could enable execution of forbidden database functions and lead to unauthorized read, modification, or deletion of data stored in the underlying database. The flaw does not provide arbitrary code execution on the host system, but can severely compromise data confidentiality and integrity.
Affected Systems
The flaw affects Esri ArcGIS Server products deployed on Windows and Linux platforms. Versions 12.1, 12.0, 11.5, 11.3, and 11.1—all in General Availability or Extended support—are vulnerable; unsupported or retired releases are not patchable. Administrators should verify their deployment against this list and plan upgrades or patches accordingly.
Risk and Exploitability
The CVSS score of 9.8 indicates a critical risk level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits at this time. Nonetheless, the attack vector is remote over the network; if the server allows public access, an unauthenticated user could exploit the flaw. The lack of architectural barriers and the high CVSS score imply that exploitation is likely and would have a severe impact on data security.
