Be The First To Get Support Updates
Want to know about the latest technical content and software updates?

Problem: Warning of security vulnerability in ArcGIS Server


Esri has discovered a critical security vulnerability in ArcGIS Server when specially crafted requests are sent to it. This causes improper access control validation to services, which results in secured services and their data being exposed to users who should not otherwise have access.

This issue is present in all currently supported versions of ArcGIS Server. Esri has released patches for versions 10.2.1 through 10.6. The issue has been fixed in ArcGIS Server 10.6.1.


This is a known issue which has been logged by Esri as a defect, BUG-000113291.

Solution or Workaround

Esri strongly recommends installing the relevant patch at the earliest possible opportunity.
All patches can be downloaded from the Esri Support website: ArcGIS Server Improper Access Control Security Patch
Please note that the ArcGIS Server account will be restarted while the patch is applied.
For any questions about this patch and resolving the security vulnerability, please contact Esri Technical Support.

Related Information

Last Published: 5/14/2018

Article ID: 000018314

Software: ArcGIS GeoEvent Server 10.4.1, 10.4 ArcGIS Server 10.4.1, 10.4 ArcGIS Image Server 10.4.1, 10.4