Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 3 products
| Date | Total | Labels |
|---|
| 2026-07-06 | 1 | Patch1 |
| 2026-07-08 | 1 | Disclosure1 |
| 2026-07-09 | 1 | Patch1 |
| 2026-07-13 | 1 | Disclosure1 |
| 2026-07-18 | 1 | General1 |
| 2026-07-19 | 2 | Disclosure1General1 |
| 2026-07-30 | 1 | General1 |
🚨 An internet-facing ArcGIS Server can become an unauthenticated file disclosure point. Rapid Response test now available for CVE-2026-9181. https://t.co/8umHL3bbKF
Post summary
A Rapid Response test for CVE‑2026‑9181, an ArcGIS Server unauthenticated file disclosure, is now available; no exploit code or patch details are announced.
CVE-2026-9181 (CVSS 9.8): unauthenticated path traversal in Esri ArcGIS Server. A single ../ in an upload filename escapes the upload dir and overwrites config-store — disable auth or swap the super-admin password for full site takeover. Patched in SEC2026U2; EOL 10.x remains exposed. Walkthrough https://rustlang.rs/posts/blog_cve_2026_9181_arcgis_en/
Post summary
The text discloses a high‑severity path traversal in Esri ArcGIS Server that allows full site takeover, provides a patch reference, and includes a walkthrough link for more detail.
🚨 CVE-2026-9181 — CVSS 9.8/10 ██████████ ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker could exploit this issue by... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/8xzDQ2fPBe
Post summary
The tweet announces a critical directory traversal flaw in ArcGIS Server (CVE‑2026‑9181, CVSS 9.8/10) and urges users to apply the patch immediately.
CVE-2026-9181: ArcGIS Server Directory Traversal - What It Means for Your Business and How to Respond https://hubs.li/Q04rqzxM0
Post summary
An advisory article about CVE-2026-9181 that highlights a directory traversal flaw in ArcGIS Server, but provides no explicit PoC, exploit, patch, or evidence of active exploitation.
【緊急】CVE-2026-9181 EsriのArcGIS Serverに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/13/cve-2026-9181-arcgis-server/ #IT #Security #cybersecurity
Post summary
The post alerts that CVE-2026-9181 is a critical vulnerability in Esri’s ArcGIS Server, calling for immediate action, yet it offers no technical specifics or remediation guidance.
【緊急】CVE-2026-9181 EsriのArcGIS Serverに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/13/cve-2026-9181-arcgis-server/ #IT #Security #cybersecurity
Post summary
The post alerts that CVE-2026-9181 is a serious vulnerability requiring immediate attention, but it provides no specific technical details, exploit code, patch information, or evidence of active exploitation.
【緊急】CVE-2026-9181 EsriのArcGIS Serverに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/13/cve-2026-9181-arcgis-server/ #IT #Security #cybersecurity
Post summary
The post warns of a critical vulnerability in Esri ArcGIS Server (CVE‑2026‑9181) but offers no additional details, evidence of exploitation, patches, or proof‑of‑concept information.
🚨 CRITICAL: CVE-2026-9181 (CVSS 9.8) Esri ArcGIS Server directory traversal flaw allows unauthenticated attackers to overwrite sensitive files & gain full admin access. Affected: ArcGIS Server ≤12.0 (Windows/Linux) NOT affected: ArcGIS Enterprise on Kubernetes #CVE #PatchNow https://t.co/UITkr9PDmK
Post summary
The tweet announces CVE‑2026‑9181, a critical directory traversal vulnerability in Esri ArcGIS Server (≤12.0) that lets unauthenticated users overwrite files and gain admin rights, and it urges users to patch promptly.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | esri | arcgis_server | - | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |