Unrated severityNVD Advisory· Published Oct 22, 2025· Updated Feb 26, 2026
BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.
CVE-2025-57870
Description
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
Affected products
2- Range: >=11.3, <=11.5
- Esri/ArcGIS Serverv5Range: 11.3
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.