EUVD-2026-64156
GHSA-vcgh-rjxj-63w5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing Portal for ArcGIS instance
-
ExploitSend unauthenticated HTTP request to protected endpoint
-
ExecutionServer returns restricted resource without authentication check
-
ImpactAttacker harvests exposed metadata or configuration data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of Portal for ArcGIS. Any attacker with TCP/IP connectivity to the Portal's HTTP or HTTPS interface can reach and exploit the affected endpoint without any account, session token, or precondition. The primary limiting factors are: (1) network reachability - instances restricted to internal networks or behind VPN significantly reduce attacker access; (2) version scope - only versions 11.1 through 12.0 are affected, and upgraded instances are not; (3) impact scope - only a single specific non-user-content resource is exposed, not broader organizational data or administrative controls. The specific resource identity and its sensitivity are not disclosed by Esri, which prevents precise impact characterization. |
| Impact | The CVSS 5.3 Medium vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the technical characteristics: the flaw is trivially reachable over the network with no privileges or user interaction, but impact is capped at limited confidentiality loss with no integrity or availability consequence. Real-world risk scales sharply with network exposure - internet-facing Portal deployments carry meaningfully higher risk than air-gapped or VPN-isolated instances, because AV:N/AC:L/PR:N means any attacker who can reach the HTTP interface can immediately exploit it with no additional effort. No EPSS data was provided in the source intelligence, and the CVE is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. The combination of zero-barrier exploitation (no authentication, no complexity) and broad network reachability in many government and enterprise deployments justifies treating this as a prompt patching priority despite the Medium CVSS score. |
| Exploit ScenarioDerived | An attacker enumerates internet-facing Esri Portal for ArcGIS instances and identifies one running version 11.1 through 12.0. Without supplying any credentials, the attacker sends a direct HTTP GET request to the unguarded resource endpoint. The server responds with the protected resource content due to the absent authentication check, potentially exposing internal configuration, metadata, or service-layer information useful for further reconnaissance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 21, 2026
Missing authentication in Esri Portal for ArcGIS versions 11.1 through 12.0 permits a remote unauthenticated attacker to read a specific internal resource intended to be access-controlled. The flaw (CWE-306) means one or more endpoints fail to enforce authentication before returning protected content, though the exposed resource is explicitly scoped to non-user data. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 5.3 Medium rating reflects the bounded confidentiality-only impact.
RemediationAI
Esri's primary recommendation is to upgrade to the latest long-term support (LTS) release of ArcGIS Enterprise; the exact patched version number is not independently confirmed from available input data and should be verified against the August 2026 ArcGIS Security Bulletin at https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin. Organizations running versions 11.1, 11.3, 11.5, or 12.0 should prioritize this upgrade. As a compensating control prior to patching, restrict network-level access to the Portal for ArcGIS web interface using perimeter firewall rules or a reverse proxy with IP allowlisting, blocking inbound requests from untrusted networks to the Portal's HTTP/HTTPS ports; note this will impact legitimate remote users and should be balanced against operational requirements. Do not treat the resource's non-user-content classification as a reason to delay patching - the specific content exposed and its sensitivity are not disclosed by Esri.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Esri Portal for ArcGIS is the web application layer of the ArcGIS Enterprise platform, providing GIS data cataloging, sharing, and organizational administration (CPE: cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*). The root cause is CWE-306 (Missing Authentication for Critical Function), indicating that one or more server-side resource endpoints lack a proper authentication gate before responding to HTTP requests. This is a server-side access-control defect rather than a client-side bypass - the endpoint simply does not verify identity before serving the resource. The narrow scope (a single specific resource, not user content) suggests this is an administrative metadata or configuration endpoint where a guard was omitted rather than a broad authorization failure across the platform.
Know when Portal For Arcgis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no authentication, complexity, or user interaction required; confidentiality impact is low and bounded to one resource; no integrity or availability impact applies.
Primary rating from Vendor (Esri).
CVSS VectorVendor: Esri
DescriptionCVE.org
There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Portal For Arcgis
View allThere is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Rated critical severity (CVSS 9.9), this vulnerabi
Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a
Unauthenticated access to administrative API endpoints in Esri Portal for ArcGIS can let remote attackers reach /portala
Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 an
Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly
There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, una
There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 a
There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS version
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may all
There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that
Exploit-DB