CVE-2026-2813 Unvalidated Redirect in ArcGIS Server

Medium 4.7 Published 20 May 2026 Updated 20 May 2026

An authenticated attacker can redirect users to untrusted sites via ArcGIS Server login, potentially exposing limited confidential data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-2813?

CVE-2026-2813 is a medium-severity vulnerability in Esri Arcgis Server, published on 20 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions. The vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible. This issue affects ArcGIS Server 11.5.

Weakness: CWE-601

Which versions are affected by CVE-2026-2813?

It affects 1 product.

Products include Esri Arcgis Server.

How do I fix CVE-2026-2813?

No fix has been published for CVE-2026-2813 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-2813 being exploited?

There is no known exploitation of CVE-2026-2813 in the wild and no public exploit code.

All Esri Arcgis Server vulnerabilities

Sources

Also known as GHSA-48m7-r7vc-4m4f.