Skip to main content

Portal for ArcGIS EUVDEUVD-2026-64154

| CVE-2026-69225 HIGH
Information Exposure (CWE-200)
2026-08-21 Esri GHSA-mm78-wrv5-7cqv
Information Disclosure Portal For Arcgis Esri
7.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (Esri) PRIMARY
MEDIUM
qualitative
NVD
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
7.5 HIGH

Network-accessible without credentials or interaction; confidentiality high as sensitive data is reflected; no integrity or availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Esri).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Updated
Sep 11, 2026 - 18:31 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 11, 2026 - 18:22 vuln.today
cvss_changed
Severity Changed
Sep 11, 2026 - 18:22 NVD
MEDIUM HIGH
CVSS changed
Sep 11, 2026 - 18:22 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Analysis Generated
Aug 21, 2026 - 21:16 vuln.today

DescriptionNVD

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

AnalysisAI

Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 allows remote unauthenticated attackers to extract sensitive data reflected in HTTP response bodies via crafted requests. The vulnerability (CWE-200) requires no authentication or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, meaning any internet-exposed Portal instance in the affected version range is potentially reachable without credentials. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required; exploitation is possible against any network-accessible Portal for ArcGIS instance running versions 11.5 through 12.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.5 score reflects a fully remote, unauthenticated, low-complexity attack with high confidentiality impact but no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the patch or upgrade as specified in Esri's August 2026 ArcGIS Security Bulletin (https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin); the exact fixed version is not independently confirmed from available data beyond the bulletin reference. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify and inventory all Portal for ArcGIS instances running versions 11.5-12.0 in your environment, noting which are internet-accessible and which data repositories they expose. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Portal For Arcgis

View all
CVE-2024-25693 CRITICAL
9.9 Apr 04

There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Rated critical severity (CVSS 9.9), this vulnerabi
CVE-2026-13019 CRITICAL
9.8 Jul 07

Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a
CVE-2026-13020 CRITICAL
9.8 Jul 07

Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten
CVE-2025-2538 CRITICAL
9.8 Mar 20

A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 an
CVE-2026-33519 CRITICAL
9.8 Apr 21

Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly
CVE-2026-33518 CRITICAL
9.8 Apr 21

Privilege escalation in Esri Portal for ArcGIS 11.5 on Windows and Linux allows highly privileged users to mint develope
CVE-2022-38193 CRITICAL
9.6 Aug 16

There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, una
CVE-2023-25832 HIGH
8.8 May 09

There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an

CVE-2021-29108 HIGH
8.8 Oct 01

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 a
CVE-2024-25699 HIGH
8.5 Apr 04

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS version
CVE-2023-25837 HIGH
8.4 Jul 21

There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may all
CVE-2023-25835 HIGH
8.4 Jul 21

There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-64154 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy