CVE-2024-51954 Unauthorized access to secure services in ArcGIS Server

High 8.5 Published 3 Mar 2025 Updated 6 Feb 2026

A low-privileged attacker can access unauthorized secure services in standalone ArcGIS Server instances, leading to data exposure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-51954?

CVE-2024-51954 is a high-severity missing authorization vulnerability in Esri Arcgis Server, published on 3 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfederated) ArcGIS Server instance. Successful exploitation results in unauthorized access to protected services outside the attacker’s originally assigned authorization boundary, constituting a scope change. If exploited, this issue would have a high impact on confidentiality, a low impact on integrity, and no impact on the availability of the software.

Weakness: CWE-284

Which versions are affected by CVE-2024-51954?

It affects 1 product.

Products include Esri Arcgis Server.

How do I fix CVE-2024-51954?

No fix has been published for CVE-2024-51954 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-51954 being exploited?

There is no known exploitation of CVE-2024-51954 in the wild and no public exploit code.

All Esri Arcgis Server vulnerabilities

Sources

Also known as GHSA-cxm9-pc6x-88r5.