ArcGIS Server 11.5 contains an input validation weakness in its login redirection logic that can be exploited by an authenticated attacker to cause the client browser to redirect to an untrusted external site. This open redirect vulnerability is confined to client-side navigation during authentication and does not allow server-side compromise or cross-component impact. The issue results in limited confidentiality impact contingent on user interaction.

Successful exploitation may lead to users being redirected to malicious or untrusted websites, potentially exposing them to phishing or other social engineering attacks. However, the impact is limited to confidentiality and requires user interaction. There is no impact on server integrity, availability, or other components of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious of unexpected redirects after authentication and consider additional user awareness training regarding phishing risks. No official mitigation or workaround has been provided by Esri at this time.