CVE-2026-2812: ArcGIS Server Auth Bypass Vulnerability

CVE-2026-2812 Overview

CVE-2026-2812 is an improper authentication vulnerability [CWE-287] affecting Esri ArcGIS Server version 12.0 and earlier. The flaw resides in an undocumented administrative endpoint that fails to properly validate caller identity. An unauthenticated attacker can send a crafted network request to the endpoint and disrupt the web-based browsing interface. Esri disclosed the issue in the April 2026 security bulletin.

Critical Impact

Unauthenticated network attackers can trigger disruption of the ArcGIS Server web-based browsing interface, degrading availability of administrative functionality and limited integrity impact on affected deployments.

Affected Products

• Esri ArcGIS Server 12.0
• Esri ArcGIS Server versions prior to 12.0
• Deployments exposing the undocumented administrative endpoint to untrusted networks

Discovery Timeline

• 2026-05-20 - CVE-2026-2812 published to the National Vulnerability Database (NVD)
• 2026-05-20 - Last updated in NVD database
• April 2026 - Esri publishes the Esri Security Bulletin April 2026 covering this issue

Technical Details for CVE-2026-2812

Vulnerability Analysis

The vulnerability is classified as Improper Authentication [CWE-287]. ArcGIS Server exposes an undocumented administrative endpoint that does not enforce authentication on incoming requests. Because the endpoint is reachable over the network, an attacker without credentials can interact with administrative functionality intended only for privileged operators.

Successful exploitation disrupts the web-based browsing interface used by ArcGIS Server administrators and consumers. The disruption represents a limited integrity impact rather than full administrative compromise, as the documented effect is on the browsing surface rather than backend data confidentiality or service availability.

Root Cause

The root cause is missing authentication enforcement on an administrative route that was not included in public documentation. Undocumented endpoints often bypass the standard authentication middleware applied to documented administrative APIs. This gap allows unauthenticated callers to reach functionality that should require an authenticated administrative session.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the undocumented administrative endpoint on a reachable ArcGIS Server instance. The server processes the request without verifying the caller, leading to disruption of the web-based browsing interface. Refer to the Esri Security Bulletin April 2026 for vendor-specific technical details. No public proof-of-concept code has been verified at the time of publication.

Detection Methods for CVE-2026-2812

Indicators of Compromise

• Unauthenticated HTTP requests to ArcGIS Server administrative paths originating from external or unexpected internal sources
• Unexpected disruptions or errors reported within the ArcGIS Server web-based browsing interface
• Web server access logs showing requests to administrative URLs that lack a valid session token or authentication header

Detection Strategies

• Review ArcGIS Server access logs for requests to administrative endpoints where the authenticated user field is empty
• Correlate web interface availability incidents with anomalous request patterns to undocumented /admin paths
• Apply web application firewall (WAF) rules to flag unauthenticated calls to ArcGIS administrative routes and surface them as high-priority events

Monitoring Recommendations

• Forward ArcGIS Server and reverse-proxy logs to a centralized analytics platform for query and alerting
• Establish a baseline of legitimate administrative request sources and alert on deviations
• Monitor uptime and error rates of the ArcGIS Server browsing interface to detect availability degradation early

How to Mitigate CVE-2026-2812

Immediate Actions Required

• Apply the security update referenced in the Esri Security Bulletin April 2026 to all ArcGIS Server instances running version 12.0 or earlier
• Restrict network exposure of the ArcGIS Server administrative interface to trusted management networks only
• Audit web server and proxy logs for prior unauthenticated requests to administrative endpoints

Patch Information

Esri addressed CVE-2026-2812 in the April 2026 security release for ArcGIS Server. Administrators should consult the Esri Security Bulletin April 2026 for the specific patched build numbers and upgrade guidance applicable to their deployment.

Workarounds

• Place ArcGIS Server behind a reverse proxy or WAF that enforces authentication on all administrative paths, including undocumented ones
• Use network segmentation and firewall rules to limit access to the ArcGIS Server administrative port to authorized administrator workstations
• Disable or block public exposure of administrative endpoints until the patch is applied

# Example: restrict ArcGIS Server admin endpoint at the reverse proxy (nginx)
location ~* ^/arcgis/admin {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny  all;
    proxy_pass http://arcgis_backend;
}