ArcGIS Server contains an improper authentication weakness in an undocumented administrative endpoint. The flaw allows an unauthenticated attacker to craft a request that bypasses proper authentication checks, potentially disrupting the web‑based browsing interface. This weakness is classified as CWE‑287 and offers no elevation of privilege or code execution; the primary consequence is a denial of service to users accessing the interface.

The issue affects Esri ArcGIS Server versions 12.0 and earlier. Any deployment of these versions that exposes the undocumented administrative endpoint is vulnerable.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that an unauthenticated attacker be able to reach the target over the network; the attack method is likely remote. While no known public exploits have been reported, the potential for service disruption remains, warranting timely remediation.