CVE-2021-29102: Esri Arcgis Server

Critical severity, CVSS 9.1. EPSS: 1.6% chance of exploitation in the next 30 days.

A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.

Affected products

• Esri Arcgis Server: before 10.9.0 (fixed in 10.9.0)

Published 2021-07-11. Last modified 2026-06-17.