FAIL › dossier
ESRI
COMPANY FEDRAMP MARKETFedRAMP provider · · dossier confidence 60%
Esri is a leading GIS software provider with a history of critical vulnerabilities in its ArcGIS Server and Portal products, including remote code execution and SQL injection flaws. The company issues patches for these issues but has a track record of significant security gaps in its core products.
PROFILE
CategoryTechnologyWhat they doEsri is an American multinational geographic information system (GIS) software company that supplies mapping software used worldwide.Founded1969HQRedlands, California
Websitehttps://www.esri.com ↗
SECURITY POSTURE
Esri has a mixed security posture with a history of significant vulnerabilities in its ArcGIS Server and Portal products, including remote code execution and SQL injection flaws, though it does issue patches for these issues.
Notable failures
- CVE-2026-9182: Unrestricted file upload RCE in ArcGIS Server
- CVE-2026-13020: Weak password recovery mechanism in ArcGIS Portal
- CVE-2026-9163: SQL injection in GIS Informatics
Patterns: unpatched edge-device RCEs; weak authentication mechanisms; SQL injection in core GIS components
FAILURE HISTORY · 2
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-07-06 | CVE-2026-9182 | medium | ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload. |
| 2026-07-07 | CVE-2026-13020 | high | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators sh |
FEDRAMP CATALOG PRODUCTS · 3
| PRODUCT | STATUS | IMPACT |
|---|---|---|
| ArcGIS Online (AGO) | Authorized | LI-SaaS |
| ArcGIS Online (AGO) Moderate | In Process | Moderate |
| Esri Managed Cloud Services Advanced Plus | Authorized | Moderate |
DOSSIER SOURCES
- Esri - Company Profile - WealthRank · www.wealthrank.in
- Jack Dangermond - Forbes · www.forbes.com
- Esri (United States) — Defence Company Profile | Vuelum · vuelum.com
- Jack Dangermond — Profile · realtimebillionaires.de
- BUG-000180332 for ArcGIS GIS Server - Esri Support · support.esri.com
- Publications - ESRI · www.esri.ie
- Patch Feed - Security Patch Monitoring Dashboard for 60+ Vendors · patchfeed.dev
- BUG-000180332 for ArcGIS GIS Server - Esri Support · support.esri.com
- CVE-2026-9163: GIS Informatics SQL Injection (CVSS 9.8) | CVETodo · cvetodo.com
Open questions: What is the current patching SLA for ArcGIS Server vulnerabilities? · How does Esri handle security disclosures for defense-industrial-base clients?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-13 04:47:58.863949+00:00