CVE-2025-57870

The attacker sends a specially crafted request to a specific ArcGIS Feature Service operation, injecting malicious SQL commands without needing any permissions. The vulnerability has a network vector (AV:N), does not require user interaction or special configuration (AC:L, UI:N), making it trivial to exploit. The payload goes directly to the database engine underlying Enterprise Geodatabase.

Successful exploitation can lead to unauthorized reading, modification, or permanent deletion of data stored in Enterprise Geodatabase, and due to the maximum CVSS score of 10.0 and scope S:C, potentially also to violations of confidentiality, integrity, and availability of resources beyond the ArcGIS server itself.

Security patches for ArcGIS Server Feature Services must be applied immediately, available from the vendor at: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-feature-services-security-patch. Until the patch is installed, it is recommended to restrict network access to ArcGIS Feature Service services only to trusted sources and to increase monitoring of logs for anomalous SQL queries.

Esri ArcGIS Server versions 11.3, 11.4, and 11.5 on Microsoft Windows, Linux, and Kubernetes platforms.