CVE-2026-9181

Executive Summary

CVE-2026-9181 is a critical directory traversal vulnerability in Esri ArcGIS Server, affecting all versions up to and including 12.0. An unauthenticated attacker can exploit this flaw by sending specially crafted path parameters, allowing them to read arbitrary files from the server's filesystem. This can lead to the disclosure of sensitive configuration files, credentials, and other critical data. The vulnerability has a CVSS score of 9.8, indicating a severe risk to confidentiality, integrity, and availability. No official patch or public exploit code is currently available, but the risk is high due to the widespread use of ArcGIS Server in geospatial and mapping applications.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): High (H) – Potential to overwrite or modify files.
• Availability (A): High (H) – Could lead to denial of service or system compromise.

Threat Level: Critical. The combination of remote, unauthenticated exploitation with high impact on all three security pillars makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability resides in the web server component of ArcGIS Server, which handles HTTP requests for REST endpoints and administrative interfaces. The application fails to properly sanitize user-supplied path parameters, such as those used in file retrieval or resource loading operations.

Root Cause: The application uses user input to construct file system paths without adequate validation. For example, a request to a resource endpoint might look like:

https://target.com/arcgis/rest/services/../../../../etc/passwd

The server does not strip or reject path traversal sequences (../), allowing an attacker to navigate outside the intended web root directory.

Attack Flow:

1. An attacker identifies an ArcGIS Server endpoint that accepts a path parameter (e.g., ?f=json&path=...).
2. The attacker crafts a request with ../ sequences to traverse directories.
3. The server processes the request and returns the contents of the targeted file.
4. The attacker can read sensitive files such as web.xml, config.xml, database connection strings, or even system files like /etc/shadow.

Impact: Full read access to the server's filesystem. This can lead to credential theft, configuration disclosure, and further lateral movement within the network.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a conceptual comparison of vulnerable and secure code patterns.

Vulnerable Code (Java/Spring-like):

@GetMapping("/getFile")
public String getFile(@RequestParam("path") String path) {
    // Directly uses user input without validation
    File file = new File("/var/www/arcgis/" + path);
    return readFile(file);
}

Patched Code (Conceptual):

@GetMapping("/getFile")
public String getFile(@RequestParam("path") String path) {
    // Normalize and validate the path
    Path basePath = Paths.get("/var/www/arcgis/").toRealPath();
    Path resolvedPath = basePath.resolve(path).normalize();
    if (!resolvedPath.startsWith(basePath)) {
        throw new SecurityException("Invalid path");
    }
    return readFile(resolvedPath.toFile());
}

The patched version uses Path.normalize() to resolve ../ sequences and then checks that the resulting path is still within the intended base directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Target: ArcGIS Server 12.0 running on Windows Server 2022 or Linux.
• Attacker: Kali Linux with curl or Burp Suite.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common targets include:
   • /arcgis/rest/services
   • /arcgis/admin
   • /arcgis/manager
2. Craft a request to read a sensitive file:

   curl -v "http://target.com/arcgis/rest/services/../../../../etc/passwd"
   

3. For Windows targets, try:

   curl -v "http://target.com/arcgis/rest/services/../../../../windows/win.ini"
   

4. If the server returns the file content, the vulnerability is confirmed.

Advanced Exploitation:

• Use URL encoding to bypass basic filters: %2e%2e%2f for ../.
• Attempt to read configuration files like config.xml or web.xml to extract database credentials.
• Use the vulnerability to read the ArcGIS Server keystore or SSL certificates.

Blue Team (Defense)

Detection:

• Monitor web server logs for requests containing ../ or %2e%2e%2f.
• Look for requests to sensitive files like /etc/passwd, web.xml, or config.xml.
• Use the detection rules provided below.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file system permissions so that the web server user has minimal read access.
• Apply virtual patching by modifying the application's input validation (if source code is available).
• Monitor for unusual outbound connections from the ArcGIS Server.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ or %2e%2e%2f in the URI.
  • Requests to endpoints like /arcgis/rest/services/../../../../etc/passwd.
  • Unusual file read patterns (e.g., reading web.xml, config.xml, shadow).
• File System IOCs:
  • Unexpected access to files outside the web root.
  • Presence of temporary files or logs indicating traversal attempts.
• Log IOCs:
  • Web server logs showing 200 OK responses for requests to system files.
  • Error logs with "File not found" for paths that should not be accessible.

Detection Engineering

YARA Rule

rule CVE_2026_9181_ArcGIS_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against ArcGIS Server"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-9181"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e\\"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "web.xml"
        $sensitive3 = "config.xml"
        $sensitive4 = "win.ini"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: ArcGIS Server Directory Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts against ArcGIS Server (CVE-2026-9181)
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e\\'
        cs-uri-stem|contains:
            - '/arcgis/rest/services'
            - '/arcgis/admin'
            - '/arcgis/manager'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some configurations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-9181 ArcGIS Server Directory Traversal"; flow:to_server,established; content:"/arcgis/"; http_uri; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Server: If possible, disconnect the ArcGIS Server from the internet or restrict access to trusted IPs only.
2. Apply Virtual Patching: Use a WAF to block requests containing ../ or %2e%2e%2f in the URI.
3. Review Access Controls: Ensure the web server user has minimal file system permissions.

Long-Term Fix:

• Vendor Patch: Monitor Esri's security advisories for an official patch. As of now, no patch is available.
• Code Modification: If you have access to the source code, implement proper path validation as shown in the "Vulnerable vs. Patched Code" section.
• Upgrade: Consider upgrading to a newer version of ArcGIS Server if a patched version becomes available.

Workaround:

• Disable unnecessary REST endpoints or administrative interfaces.
• Use a reverse proxy to filter malicious requests before they reach the ArcGIS Server.

Valters IT