Critical severity10.0NVD Advisory· Published Oct 22, 2025· Updated Sep 26, 2026
CVE-2025-57870
CVE-2025-57870
Description
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
Affected products
3cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*range: >=11.3,<=11.5
- (no CPE)range: 11.3
- (no CPE)range: 11.3, 11.4, 11.5
Patches
Vulnerability mechanics
References
1- www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-feature-services-security-patchnvdMitigationVendor Advisory
News mentions
0No linked articles in our index yet.