There is an improper access control issue in ArcGIS Server.

Description

Esri has discovered a critical security vulnerability in ArcGIS Server when specially crafted requests are sent to it. This causes improper access control validation to services, which results in secured services and their data being exposed to users who should not otherwise have access.

This issue is present in all currently supported versions of ArcGIS Server. Esri has released patches for versions 10.2.1 through 10.6. The issue has been fixed in ArcGIS Server 10.6.1.

Cause

This is a known issue which has been logged by Esri as a defect, BUG-000113291.

Workaround

Esri strongly recommends installing the relevant patch at the earliest possible opportunity.
All patches can be downloaded from the Esri Support website: ArcGIS Server Improper Access Control Security Patch
Please note that the ArcGIS Server account will be restarted while the patch is applied.
For any questions about this patch and resolving the security vulnerability, please contact Esri Technical Support.

Steps to Reproduce