Portal for ArcGIS CVE-2026-69225

No authentication is required; exploitation is possible against any network-accessible Portal for ArcGIS instance running versions 11.5 through 12.0. The attack vector is network (AV:N) with low complexity (AC:L) and no required user interaction (UI:N). The primary limiting factor is the 'Automatable: no' SSVC assessment, which implies the attack likely requires knowledge of specific endpoint paths or request structures rather than a generic scanner approach - reducing the risk of opportunistic mass exploitation. Deployments with no internet exposure or protected behind authenticated network boundaries (VPN, firewall ACLs) are not reachable from external attackers.

The CVSS 7.5 score reflects a fully remote, unauthenticated, low-complexity attack with high confidentiality impact but no integrity or availability consequence. However, several signals temper the urgency: EPSS is only 0.33% (26th percentile), indicating very low observed exploitation probability in the wild. SSVC rates exploitation as none and technical impact as partial, which is somewhat inconsistent with NVD's C:H - this discrepancy likely reflects that while the confidentiality impact is theoretically high if sensitive tokens or credentials are reflected, the SSVC assessors found no evidence of active use and the partial technical impact suggests the disclosed data may not be universally critical. The 'Automatable: no' SSVC rating despite the low-complexity CVSS vector suggests the attack likely requires endpoint knowledge or crafted request parameters, limiting mass automated scanning. Overall, this is a medium-urgency issue - real and patchable, but not an immediate crisis for most deployments absent evidence of targeting.

An unauthenticated attacker identifies an internet-exposed Portal for ArcGIS instance in the affected version range and sends a crafted HTTP request - potentially embedding manipulated query parameters or headers - to a vulnerable endpoint. The Portal reflects sensitive data (such as internal tokens, session identifiers, or configuration fragments) back in the HTTP response body, which the attacker reads directly. No public exploit code is known, but the low complexity and absence of authentication requirements mean a manually crafted request is sufficient.