CVE-2024-51954: Esri ArcGIS Server · Improper Access Control
Affects Esri ArcGIS ServerSource CVE Database V5
Not known to be exploited · CVSS 8.5 High.
Data as of 26 Oct 2026, 11:07 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 3 Mar 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Esri ArcGIS Server | Affected
| Fixed in– |
AI-suggested
- Conduct immediate access control audits on all standalone ArcGIS Server instances to verify that service permissions are correctly configured and no unauthorized access paths exist.
- Implement strict network segmentation and firewall rules to limit ArcGIS Server access only to trusted internal networks and authenticated users.
- Monitor ArcGIS Server logs for unusual access patterns or attempts to access services outside assigned permissions.
- Apply the principle of least privilege rigorously for all authenticated users interacting with ArcGIS Server.
- Where possible, federate ArcGIS Server instances with ArcGIS Enterprise to leverage centralized security controls and reduce standalone exposure.
- Stay alert for official patches or updates from Esri and apply them promptly once available.
- Consider deploying Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) with signatures tuned for ArcGIS Server traffic to detect anomalous requests.
- Educate administrators and users about the risks of improper access control and enforce strong authentication mechanisms.
- Review and update incident response plans to include scenarios involving unauthorized access to geospatial data.
Description
There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfederated) ArcGIS Server instance. Successful exploitation results in unauthorized access to protected services outside the attacker’s originally assigned authorization boundary, constituting a scope change. If exploited, this issue would have a high impact on confidentiality, a low impact on integrity, and no impact on the availability of the software.