Esri ArcGIS Server versions 12.0 and earlier contain an improper authentication vulnerability (CWE-287) in an undocumented administrative endpoint. An unauthenticated attacker can exploit this by sending a crafted request to this endpoint, potentially causing disruption to the web-based browsing interface. The vulnerability does not affect confidentiality or availability but impacts integrity to a limited extent. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, and no user interaction needed. No patch or official remediation level has been disclosed by Esri as of the publication date.

Successful exploitation allows an unauthenticated attacker to disrupt the web-based browsing interface of ArcGIS Server, impacting the integrity of the service's interface. There is no impact on confidentiality or availability reported. The disruption could affect user interaction with the server's web interface but does not lead to data disclosure or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided by Esri, users should monitor Esri advisories for updates. Until a fix is available, restricting access to administrative endpoints and applying network-level controls to limit exposure may help reduce risk.