ArcGIS Blog

Administration

ArcGIS Trust Center

Oct 14, 2026

October 2026 ArcGIS Security Bulletin

By Mark Bierman and Michael Young

October 13, 2026

The ArcGIS Server Security 2026 Update 3 Patch has been released and is available here.

This patch resolves several critical, high, and moderate severity security vulnerabilities in ArcGIS Server versions 12.1 and earlier on Windows and Linux platforms.

This patch was released on October 13th, 2026. We strongly encourage ArcGIS Enterprise customers to install this patch ASAP to minimize risk.

Patch Notes:

  • Cumulative – This patch is cumulative and does not require that you install any previous ArcGIS Server Security patches prior to installing this patch – Using the Patch Notification Utility can help ease this process. This patch is NOT dependent on other patches to be in place.
  • Esri has reserved CVE identifiers for the vulnerabilities fixed in this patch.
  • Mitigation – In order to mitigate these vulnerabilities, we strongly recommend all ArcGIS Enterprise customers install this patch as soon as possible.
    • All issues are immediately remediated by installing this patch.
    • Your Web Application Firewall (WAF) will help to block malicious patterns.
    • Implementing the basic profile in the ArcGIS Hardening guide will reduce exposure.

Vulnerability Details

 

 

 

 

 

_____________________________________________________________________________________________________________________________

October 21, 2026

ArcGIS Velocity for ArcGIS Enterprise 12.1 Patch 1 has been released and is available here.

This patch resolves three critical and high severity security vulnerabilities in ArcGIS Velocity for ArcGIS Enterprise version 12.1 on Windows and Linux platforms.

This patch was released on October 20th, 2026. We strongly encourage ArcGIS Velocity customers to install this patch ASAP to minimize risk.

Patch Notes:

  • This is the first patch for ArcGIS Velocity and includes all current security fixes.
  • Remediation – In order to remediate these vulnerabilities, we strongly recommend all ArcGIS Velocity for ArcGIS Enterprise customers install this patch as soon as possible.
  • Mitigations include:
    • All issues are immediately remediated by installing this patch.
    • Your Web Application Firewall (WAF) will help to block malicious patterns.

Vulnerability Details

 

Share this article

administration announcements arcgis trust center cve security ssamlmygp arcgis trust center

Commenting is not enabled for this article.