CVE-2026-9182 describes an unrestricted file upload vulnerability in Esri ArcGIS Server. An unauthenticated attacker can exploit this flaw by uploading a crafted file to an affected endpoint, potentially allowing arbitrary file uploads. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No vendor advisory or patch information is available to confirm remediation status or affected versions.

Successful exploitation allows an unauthenticated attacker to upload arbitrary files to the ArcGIS Server, which could lead to limited integrity impact. There is no direct confidentiality or availability impact indicated. The ability to upload arbitrary files could be leveraged in further attacks depending on server configuration and file handling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Esri's advisories for updates. Until a patch is available, consider restricting access to upload endpoints and implementing additional file validation controls if possible.