Problem: Warning of security vulnerability in ArcGIS Server
Esri has discovered a critical security vulnerability in ArcGIS Server when specially crafted requests are sent to it. This causes improper access control validation to services, which results in secured services and their data being exposed to users who should not otherwise have access.
This issue is present in all currently supported versions of ArcGIS Server. Esri has released patches for versions 10.2.1 through 10.6. The issue has been fixed in ArcGIS Server 10.6.1.
This is a known issue which has been logged by Esri as a defect, BUG-000113291.
Solution or Workaround
Esri strongly recommends installing the relevant patch at the earliest possible opportunity.
All patches can be downloaded from the Esri Support website: ArcGIS Server Improper Access Control Security Patch
Please note that the ArcGIS Server account will be restarted while the patch is applied.
For any questions about this patch and resolving the security vulnerability, please contact Esri Technical Support.
Last Published: 5/14/2018
Article ID: 000018314
Software: ArcGIS GeoEvent Server 10.4.1, 10.4 ArcGIS Server 10.4.1, 10.4 ArcGIS Image Server 10.4.1, 10.4