Latest Contributions by vipulsoni

Greetings All, we have received multiple alerts from Cybersecurity Team for the - CVE-2026-29146, tomcat software present in almost all the Esri Enterprise Products. 11.3 and 11.5 installations of ArcGIS Server and ArcGIS Portal, ArcGIS Data Store. I am unable to find any ESRI Patch or Document stating the vulnerability mitigation patch or the affect of this vulnerability to ESRI Enterprise Software Suite.   SoftwareName SoftwareVersion CveId EvidencePaths tomcat 9.0.84.0 CVE-2026-29146 ["c:\\program files\\arcgis\\server\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar"] tomcat 9.0.84.0 CVE-2026-29146 ["c:\\program files\\arcgis\\datastore\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar","c:\\program files\\arcgis\\portal\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar","c:\\program files\\arcgis\\server\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar"] tomcat 10.1.34.0 CVE-2026-29146 ["c:\\program files\\arcgis\\server\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar"] tomcat 10.1.34.0 CVE-2026-29146 ["c:\\program files\\arcgis\\server\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar"] tomcat 10.1.34.0 CVE-2026-29146 ["c:\\program files\\arcgis\\server\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar"] tomcat 10.1.34.0 CVE-2026-29146 ["c:\\program files\\arcgis\\server\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar"] tomcat 9.0.84.0 CVE-2026-29146 ["c:\\program files\\arcgis\\datastore\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar","c:\\program files\\arcgis\\server\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar"] tomcat 9.0.62.0 CVE-2026-29146 ["c:\\program files\\arcgis\\datastore\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar","c:\\program files\\arcgis\\server\\framework\\runtime\\tomcat\\bin\\tomcat-juli.jar"] ... View more

Hi, We have ArcGIS Server 11.5 and ArcGIS Portal 11.3 in production environment with the below highlighted vulnerabilities by our organization Cyber Security Team. please need advice for the same, since i have not been able to find any patches or documents which addresses the exact same vulnerabilities for the specific ArcGIS Enterprise Versions. --------------------------------------------------------------------------------------------------------------------------- This advisory addresses Apache Tomcat security updates addressing two major vulnerabilities, impacting several supported versions of its open-source application server. These vulnerabilities could be exploited to carry out session fixation attacks or trigger denial-of-service (DoS) using the MadeYouReset method in HTTP/2. CVE-2025-55668 - Session Fixation via Rewrite Valve 6.5 Medium Apache Tomcat's rewrite valve mechanism contains a session fixation flaw, which could let attackers assign a session ID to a user before they log in, potentially enabling session hijacking. CVE-2025-48989 - Denial-of-Service via MadeYouReset HTTP/2 Technique 7.5 High Apache Tomcat is susceptible to the MadeYouReset attack, which exploits the HTTP/2 protocol by mishandling stream resets, leading to resource exhaustion. ... View more

Hi, We have ARCGIS Server 11.3 deployed in Production environment and recently the Cybersecurity Department flagged a vulnerability presence. Vulnerability Details -  CVE-2024-56337: Apache Tomcat Patches Critical Remote Code Execution Vulnerability (Update Apache Tomcat )- The vulnerability stems from an incomplete mitigation of previous vulnerability (CVE-2024-50379). The flaw is exploitable on case-insensitive file systems where Tomcat’s default servlet has write functionality enabled. By manipulating specific paths, attackers can bypass security measures and upload malicious JSP files, leading to remote code execution. Exploitation of this vulnerability enables attackers to execute arbitrary code on the affected server, potentially granting them complete control over the system. Installed Version - Apache Tomcat - 9.0.84.0 (ArcGIS 11.3) (Affected Version). Product Affected Versions  Apache Tomcat 11.0.0-M1 to 11.0.1 10.1.0-M1 to 10.1.33 9.0.0.M1 to 9.0.97 Fixed Tomcat Versions - 11.0.2 or later 10.1.34 or later 9.0.98 or later Similar Post (but without any solution) -  https://community.esri.com/t5/arcgis-enterprise-questions/does-apache-tomcat-come-embedded-with-arcgis/td-p/1078440/page/2 We planned to fix this but came to understand from the above Post that even if try upgrading the Production Environment to ArcGIS Enterprise 11.4 the Apache Tomcat Version Embedded comes with vulnerable version -  Apache Tomcat -9.0.93. This issue of Apache Tomcat needs a Patch from ESRI for the  ArcGIS Enterprise 11.3 and 11.4 versions as well. ... View more