CVE-2026-2812 is an improper authentication vulnerability (CWE-287) in Esri ArcGIS Server affecting version 12.0 and earlier, including 11.1. The flaw exists in an undocumented administrative endpoint that does not properly authenticate requests. An unauthenticated attacker can exploit this by sending crafted requests, leading to disruption of the web-based browsing interface. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability.

Successful exploitation may disrupt the web-based browsing interface of the ArcGIS Server, potentially impacting the integrity of the service interface. There is no impact on confidentiality or availability reported. No known active exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor Esri advisories for updates. Until a patch is available, restricting access to administrative endpoints and applying network-level controls to limit exposure may reduce risk.