What is the CVSS score of CVE-2026-69224?

CVE-2026-69224 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Portal for ArcGIS are affected by CVE-2026-69224?

Esri Portal for ArcGIS versions 11.1 through 12.0 contain an information exposure vulnerability allowing unauthenticated attackers to retrieve sensitive data through crafted HTTP requests.

How to fix or mitigate CVE-2026-69224?

Within 24 hours, identify all Esri Portal instances in versions 11.1-12.0 and document which systems host sensitive data; deploy web application firewall rules to detect anomalous request patterns targeting HTTP response reflection, and enable detailed logging of API requests. Within 7 days, classify Portal datasets by sensitivity level, conduct audit trails for any unusual API access, and assess data exposure scope; brief legal and compliance teams if sensitive information has been accessed. Within 30 days, test and stage an upgrade to Portal version 12.1 or later (pending vendor confirmation of fix), prioritizing systems with classified or business-critical geospatial data, and validate that the upgrade resolves the reflection issue in your environment.

Portal for ArcGIS CVE-2026-69224

EUVD-2026-64152 HIGH

Information Exposure (CWE-200)

2026-08-21 Esri

GHSA-59p7-v6qm-vh55

Information Disclosure Portal For Arcgis Esri

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (Esri) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

AC:H reflects vendor-stated difficult-to-reproduce conditions; C:H retained for potentially sensitive reflected data; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Esri).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Sep 11, 2026 - 18:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 11, 2026 - 18:22 vuln.today

cvss_changed

Severity Changed

Sep 11, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

Sep 11, 2026 - 18:22 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Aug 21, 2026 - 21:15 vuln.today

DescriptionNVD

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

AnalysisAI

Sensitive information reflection in Esri Portal for ArcGIS versions 11.1 through 12.0 exposes confidential content in HTTP response bodies to remote, unauthenticated attackers under specific, difficult-to-reproduce conditions. The vulnerability stems from improper information exposure (CWE-200), where a crafted request can cause the server to echo sensitive data back in its response. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The vulnerability requires that the attacker identify and meet 'difficult to reproduce circumstances' as stated by the vendor, meaning a specific - but undisclosed - combination of request parameters, headers, or application state must be satisfied. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The risk picture for this vulnerability is mixed and contains a notable internal contradiction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patch or upgrade referenced in the Esri August 2026 ArcGIS Security Bulletin (https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Esri Portal instances in versions 11.1-12.0 and document which systems host sensitive data; deploy web application firewall rules to detect anomalous request patterns targeting HTTP response reflection, and enable detailed logging of API requests. …

Threat intelligence, references, and detailed analysis are available after sign-in.