17
CVEs
3
Critical
3
High
0
KEV
1
PoC
4
Unpatched C/H
11.8%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
3
MEDIUM
11
LOW
0
Monthly CVE Trend
Affected Products (19)
Portal For Arcgis
88
Arcgis Server
59
Open Redirect
11
Arcgis Pro
6
Arcgis Enterprise
5
Kubernetes
4
Arcmap
4
Arcgis Engine
3
Arcreader
3
Arcgis Insights
2
Arcgis Allsource
2
Jwt Attack
1
Arcgis For Desktop
1
Arcgis Earth
1
Arcgis For Engine
1
Windows
1
Arcgis Geoevent Server
1
PHP
1
Arcgis Quickcapture
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-13019 | Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a critical API endpoint that a remote, unauthenticated attacker can reach directly, bypassing access controls to interact with functionality that should require an authenticated session. Esri rates this critical (CVSS 9.8) and disclosed it in its June 2026 ArcGIS security bulletin; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the exposed function is an administrative/portal API reachable over the network with no credentials, successful access could lead to disclosure or manipulation of portal content and configuration. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-13020 | Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten-password recovery mechanism (CWE-640) that a remote, unauthenticated attacker can manipulate to assume ownership of another user's account. The flaw carries a CVSS 9.8 rating because it is network-reachable with no authentication or user interaction, yielding full compromise of confidentiality, integrity, and availability of the targeted account. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), and CISA's SSVC framework records exploitation as none, indicating no observed in-the-wild activity despite the critical score. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-9181 | Unauthenticated file disclosure in Esri ArcGIS Server (all versions 12.0 and prior) lets remote attackers read sensitive files by supplying crafted path parameters that escape the intended directory. The flaw is network-reachable with no authentication or user interaction and, per CISA's SSVC framework, is automatable with total technical impact, though no public exploit has been identified and EPSS exploitation probability remains modest at 0.72%. Esri disclosed and patched the issue in its May 2026 ArcGIS security bulletin. | HIGH | 7.5 | 0.7% | 38 |
PoC
No patch
|
| CVE-2026-69224 | Sensitive information reflection in Esri Portal for ArcGIS versions 11.1 through 12.0 exposes confidential content in HTTP response bodies to remote, unauthenticated attackers under specific, difficult-to-reproduce conditions. The vulnerability stems from improper information exposure (CWE-200), where a crafted request can cause the server to echo sensitive data back in its response. No active exploitation has been confirmed, and EPSS probability is low at 0.33%, though CVSS rates confidentiality impact as high given the potential sensitivity of reflected data. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-69225 | Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 allows remote unauthenticated attackers to extract sensitive data reflected in HTTP response bodies via crafted requests. The vulnerability (CWE-200) requires no authentication or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, meaning any internet-exposed Portal instance in the affected version range is potentially reachable without credentials. No public exploit or KEV listing exists at time of analysis, and SSVC classifies exploitation as none with partial technical impact, indicating limited observed threat activity despite the high confidentiality impact scored by NVD. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-9182 | Unrestricted file upload in Esri ArcGIS Server (all versions through 12.0) lets a remote, unauthenticated attacker push arbitrary files to an exposed administrative/upload endpoint, per CVSS PR:N. Esri self-reported the flaw (CWE-434) and rates it critical (CVSS 9.8), and successful upload of an executable payload can lead to full server compromise. There is no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile), indicating it is not yet a mass-exploitation target. | CRITICAL | 9.8 | 0.2% | 35 |
No patch
|
| CVE-2026-69234 | Reflected cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote, unauthenticated attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The CVSS Scope:Changed metric indicates that injected scripts may affect components beyond the vulnerable Portal itself, such as session tokens shared across an ArcGIS Enterprise deployment. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|
| CVE-2026-69236 | Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 12.1 enables a remote, privileged attacker to persist malicious JavaScript in the portal, which then executes in the browsers of users who subsequently view the affected content. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) with scope change (S:C), meaning successful exploitation crosses trust boundaries into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, and Esri has released patches via their August 2026 ArcGIS Security Bulletin. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|
| CVE-2026-69235 | Stored XSS in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker to inject persistent malicious scripts that execute in a victim's browser upon visiting affected portal content. Successful exploitation can yield session hijacking, credential theft, and unauthorized actions performed within a victim's authenticated portal session. No public exploit has been identified at time of analysis, and this CVE is not currently listed in CISA KEV. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|
| CVE-2026-69233 | Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior enables a remotely authenticated administrator to inject persistent malicious JavaScript that executes in other users' browsers upon page load. The scope change (S:C) in the CVSS vector confirms the attacker's injected payload crosses from the server context into victims' browser sessions, enabling session hijacking, credential theft, or DOM manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; Esri has issued a patch via the August 2026 ArcGIS security bulletin. | MEDIUM | 5.5 | 0.2% | 28 |
No patch
|
| CVE-2026-69231 | Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 allows a remote, privileged attacker to persist malicious JavaScript within the portal, which subsequently executes in the browsers of any user who views the affected content. The vulnerability carries a CVSS 3.1 score of 5.5 with scope change (S:C), reflecting that exploitation crosses from the portal server into victim browser sessions, enabling session hijacking, credential harvesting, or unauthorized portal actions on behalf of victims. No public exploit code or CISA KEV listing has been identified at time of analysis, but Esri has released patches for affected enterprise versions and advises upgrading to the latest long-term support release. | MEDIUM | 5.5 | 0.2% | 28 |
No patch
|
| CVE-2026-69232 | Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote attacker holding high portal privileges to persist malicious JavaScript payloads in portal content. When any other authenticated user browses the affected item, the injected script executes in their browser, enabling session hijacking, credential exfiltration, or portal actions performed on the victim's behalf. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis; however, the CVSS scope-change metric (S:C) signals that impact crosses the security boundary of the vulnerable component and extends to victims' browser sessions. | MEDIUM | 5.5 | 0.2% | 28 |
No patch
|
| CVE-2026-69229 | HTML injection in Esri Portal for ArcGIS versions 11.1 through 12.0 enables a remote authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application, potentially exposing other portal users to malicious content. The flaw is tagged as XSS and classified under CWE-79, meaning unsanitized attacker-controlled input is rendered in the browser context of other users visiting the Home application. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified, though the relatively low privilege requirement (authenticated, low-privilege user) broadens the potential attacker pool within any ArcGIS Enterprise deployment. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|
| CVE-2026-69228 | Missing authentication in Esri Portal for ArcGIS versions 11.1 through 12.0 permits a remote unauthenticated attacker to read a specific internal resource intended to be access-controlled. The flaw (CWE-306) means one or more endpoints fail to enforce authentication before returning protected content, though the exposed resource is explicitly scoped to non-user data. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 5.3 Medium rating reflects the bounded confidentiality-only impact. | MEDIUM | 5.3 | 0.3% | 27 |
No patch
|
| CVE-2026-69230 | Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker holding administrative credentials to persistently inject malicious JavaScript that executes in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload escapes the application's trust boundary and can affect lower-privileged users who simply load poisoned portal pages. No public exploit code or active exploitation has been identified at time of analysis; Esri has released guidance directing affected users to patch via the August 2026 ArcGIS Security Bulletin. | MEDIUM | 4.8 | 0.2% | 24 |
No patch
|