CVE-2025-57870 — BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated att…
Published: 2025-10-22 · CVSS: 10.0 · CVSS 3.1
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7