CVE-2022-38196: Esri Arcgis Server

High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.

Affected products

• Esri Arcgis Server: up to and including 10.9.1

Published 2022-10-25. Last modified 2026-06-17.