October 2026 ArcGIS Security Bulletin

The ArcGIS Server Security 2026 Update 3 Patch has been released and is available here.

This patch resolves several severity security vulnerabilities in ArcGIS Server versions 12.1 and earlier on Windows and Linux platforms.

This patch was released on October 13th, 2026. We strongly encourage ArcGIS Enterprise customers to install this patch ASAP to minimize risk.

Patch Notes:

• Cumulative – This patch is cumulative and does not require that you install any previous ArcGIS Server Security patches prior to installing this patch – Using the Patch Notification Utility can help ease this process. This patch is NOT dependent on other patches to be in place.
• Esri has reserved CVE identifiers for the vulnerabilities fixed in this patch.
• Mitigation – In order to mitigate these vulnerabilities, we strongly recommend all ArcGIS Enterprise customers install this patch as soon as possible.
  • All issues are immediately remediated by installing this patch.
  • Your Web Application Firewall (WAF) will help to block malicious patterns.
  • Implementing the basic profile in the ArcGIS Hardening guide will reduce exposure.

Vulnerability Details

• CVE Coming Soon
• CWE: 89
• CVSSv31: 9.8 Common Vulnerability Scoring System Version 3.1 Calculator
• Temporal CVSSv31: 9.4 Common Vulnerability Scoring System Version 3.1 Calculator
• Affected versions: (12.1, 12.0, 11.5, 11.3, 11.1)
• Platforms: Windows and Linux

• CVE Coming Soon
• CWE: 79
• CVSSv31: 6.1 Common Vulnerability Scoring System Version 3.1 Calculator
• Temporal CVSSv31: 5.8 Common Vulnerability Scoring System Version 3.1 Calculator
• Affected: (12.1, 12.0, 11.5, 11.3, 11.1)
• Platforms: Windows and Linux

• CVE Coming Soon
• CWE:79
• CVSSv31: 6.1 Common Vulnerability Scoring System Version 3.1 Calculator
• Temporal CVSSv31: 5.8 Common Vulnerability Scoring System Version 3.1 Calculator
• Affected: (12.1, 12.0, 11.5, 11.3, 11.1)
• Platforms: Windows and Linux

• CVE Coming Soon
• CWE: 400
• CVSSv31: 7.5 Common Vulnerability Scoring System Version 3.1 Calculator
• Temporal CVSSv31: 7.2 Common Vulnerability Scoring System Version 3.1 Calculator
• Affected: (12.0, 11.5, 11.3, 11.1)
• Platforms: Windows and Linux

• CVE Coming Soon
• CWE:79
• CVSSv31: 6.1 Common Vulnerability Scoring System Version 3.1 Calculator
• Temporal CVSSv31: 5.8 Common Vulnerability Scoring System Version 3.1 Calculator
• Affected: (11.5 only)
• Platforms: Windows and Linux

• CVE Coming Soon
• CWE:285
• CVSSv31:5.3 Common Vulnerability Scoring System Version 3.1 Calculator
• Temporal CVSSv31: Common Vulnerability Scoring System Version 3.1 Calculator
• Affected: (12.0, 11.5, 11.3)
• Platforms: Windows and Linux