The U.S. Geological Survey Area Species Management Research Program (ARMI) had a vulnerability allowing authenticated remote attackers to upload arbitrary files, including crafted PHP scripts, which could then be executed on the server. This could lead to remote code execution and full compromise of confidentiality, integrity, and availability. The vulnerability was fixed on 2026-07-20.