CVE-2025-57870: Esri Arcgis Server

Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days.

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.

Affected products

• Esri Arcgis Server: from 11.3, up to and including 11.5

Published 2025-10-22. Last modified 2026-09-26.