ESRI announced that there is a security vulnerability in ArcGIS server and there is a patch for 10.2.1 through 10.6.  Version 10.6.1 has already been fixed.  Click here to read the technical support article.