CVE-2026-2813
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
ArcGIS Server has an input validation weakness in the login redirection workflow. An authenticated attacker can send a crafted request, causing the browser to redirect to an untrusted site, resulting in limited confidentiality impact under specific user interaction. The vulnerability affects ArcGIS Server 11.5.
Risk Assessment
An attacker could exploit this for phishing or credential theft by redirecting the user to a malicious site.
Recommendation
Apply appropriate patches from the vendor for ArcGIS Server 11.5.
Original NVD description (English source)
ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions. The vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible. This issue affects ArcGIS Server 11.5.