The vulnerability allows an unauthenticated attacker to remotely update ArcGIS Server service metadata, potentially altering service descriptions, permissions, or removing services entirely. This flaw is an authorization failure (CWE‑285). No confidentiality or integrity compromise beyond metadata changes is described, but the ability to manipulate service configurations can enable broader attacks if services are subsequently misused.

Esri ArcGIS Server releases 11.3 through 12.0 are affected. Full patches are available for the General Availability and Extended support releases 12.0, 11.5, and 11.3. Versions in mature or retired status are not patch eligible, so installations on those releases remain vulnerable unless upgraded to a supported version.

The CVSS base score of 5.3 indicates moderate severity, and the lack of an EPSS score means the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV, suggesting no known active exploits. Attack is assumed to occur via exposed HTTP/HTTPS endpoints that manage metadata, with no authentication required. Overall risk is moderate, primarily from the potential to alter service configurations without permission.