CVE-2021-29115: Esri Arcgis Enterprise

Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days.

An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.

Affected products

• Esri Arcgis Enterprise: up to and including 10.9

Published 2021-12-07. Last modified 2026-06-17.