CVE-2026-2813
published 2026-05-20CVE-2026-2813: ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a…
PriorityP423medium4.1CVSS 3.1
AVNACLPRLUIRSCCLINAN
EPSS
0.30%
21.6th percentile
ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions.
The vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible. This issue affects ArcGIS Server 11.5.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| esri | arcgis_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-48m7-r7vc-4m4f: ArcGIS Server contains an input validation weakness in the login redirection workflow
ghsa_unreviewed·2026-05-20
CVE-2026-2813 [MEDIUM] CWE-601 GHSA-48m7-r7vc-4m4f: ArcGIS Server contains an input validation weakness in the login redirection workflow
ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions.
The vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible. This issue affects ArcGIS Server 11.5.
VulDB
Esri ArcGIS Server 11.5 redirect
vuldb·2026-05-20·CVSS 4.7
CVE-2026-2813 [MEDIUM] Esri ArcGIS Server 11.5 redirect
A vulnerability classified as problematic was found in Esri ArcGIS Server 11.5. This affects an unknown part. The manipulation results in open redirect.
This vulnerability was named CVE-2026-2813. The attack may be performed from remote. There is no available exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-20
Published