CVE-2026-69227

BUG-000187331 Portal for ArcGIS has a security vulnerability

A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69226

Portal for ArcGIS has a security vulnerability

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-10759

BUG-000171040 Portal for ArcGIS has a security vulnerability

A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-13019

Missing Authentication

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Esri Kubernetes Linux and 1 more

Products

Portal For Arcgis Kubernetes Linux Kernel and 1 more

CVE-2026-69237

HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69238

HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69224

information disclosure vulnerability in Esri Portal for ArcGIS

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69225

information disclosure vulnerability in Esri Portal for ArcGIS

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69228

missing authentication vulnerability in Esri Portal for ArcGIS

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69229

HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69230

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69231

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69232

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69233

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69234

reflected cross site scripting vulnerability in Esri Portal for ArcGIS

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. Users working with ArcGIS Web App Builder developer edition are advised to migrate to ArcGIS Experience Builder, as ArcGIS Web App Builder developer edition is unsupported when this CVE is assigned.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69235

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-69236

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encouraged to patch. All users are advised to upgrade to the latest long-term support release and apply the patch.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-13020

Weak Password Recovery Mechanism in Portal for ArcGIS

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Esri Kubernetes Linux and 1 more

Products

Portal For Arcgis Kubernetes Linux Kernel and 1 more

CVE-2022-38209

Reflected XSS vulnerability in Portal for ArcGIS

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2026-33518

Incorrect privilege assignment in Portal for ArcGIS

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Portal For Arcgis Linux Kernel Windows