Skip to main content

Portal for ArcGIS CVE-2026-69225

| EUVDEUVD-2026-64154 MEDIUM
Information Exposure (CWE-200)
2026-08-21 Esri GHSA-mm78-wrv5-7cqv
Information Disclosure Portal For Arcgis Esri
5.9
CVSS 3.1 · Vendor: Esri
Share

Severity by source

Vendor (Esri) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
5.9 MEDIUM

Network-reachable with no authentication required; AC:H reflects non-trivial exploitation conditions; confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Esri).

CVSS VectorVendor: Esri

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
Analysis Generated
Aug 21, 2026 - 21:16 vuln.today

DescriptionCVE.org

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

AnalysisAI

Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 enables remote unauthenticated attackers to obtain sensitive data reflected in HTTP response bodies. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 5.9 Medium - network-reachable with no authentication required, but high attack complexity constrains trivial mass exploitation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms the vulnerability is network-accessible and requires no authentication or user interaction, but attack complexity is high - meaning specific conditions beyond the attacker's direct control must be satisfied for exploitation to succeed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 5.9 Medium score reflects the genuine tension between high confidentiality impact (C:H) and high attack complexity (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Organizations should consult Esri's August 2026 ArcGIS Security Bulletin directly at https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin for patch download and upgrade instructions; a patch is available per vendor advisory, though the exact fixed version number was not specified in the available intelligence data and should be confirmed from the bulletin itself. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Portal For Arcgis

View all
CVE-2024-25693 CRITICAL
9.9 Apr 04

There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Rated critical severity (CVSS 9.9), this vulnerabi
CVE-2026-13019 CRITICAL
9.8 Jul 07

Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a
CVE-2026-13020 CRITICAL
9.8 Jul 07

Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten
CVE-2025-2538 CRITICAL
9.8 Mar 20

A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 an
CVE-2026-33519 CRITICAL
9.8 Apr 21

Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly
CVE-2026-33518 CRITICAL
9.8 Apr 21

Privilege escalation in Esri Portal for ArcGIS 11.5 on Windows and Linux allows highly privileged users to mint develope
CVE-2022-38193 CRITICAL
9.6 Aug 16

There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, una
CVE-2023-25832 HIGH
8.8 May 09

There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an

CVE-2021-29108 HIGH
8.8 Oct 01

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 a
CVE-2024-25699 HIGH
8.5 Apr 04

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS version
CVE-2023-25837 HIGH
8.4 Jul 21

There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may all
CVE-2023-25835 HIGH
8.4 Jul 21

There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-69225 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy