Unrated severityNVD Advisory· Published Dec 31, 2025· Updated Jan 2, 2026
Stored XSS vulnerability in ArcGIS Server.
CVE-2025-67703
Description
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.
Affected products
2- Range: <=11.4
- Esri/ArcGIS Serverv5Range: 10.9.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.