CVE-2022-38197: Esri Arcgis Server

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.

Affected products

• Esri Arcgis Server: up to and including 10.9.1

Published 2022-10-25. Last modified 2026-06-17.