CVE-2026-10757

Summary

A SQL injection flaw (CWE-89) exists in Esri ArcGIS Server versions 12.1 and earlier, allowing authenticated or potentially anonymous attackers to execute unauthorized database-specific functions due to insufficient input validation.

Exploitability

Exploitation requires valid service access credentials or public-facing service misconfiguration; no authentication bypass is needed beyond standard service access.

Blast radius

Successful exploitation could lead to full compromise of the underlying database, including data exfiltration, modification, or destruction, depending on database permissions tied to the ArcGIS service account.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ArcGIS Server version 12.2 or later (the first patched release), or apply the official patch for supported versions (12.1, 12.0, 11.5, 11.3, 11.1); unpatched mature/retired versions must be upgraded to a supported release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.