CVE-2026-33519

Incorrect privilege assignment in Portal for ArcGIS

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Esri Kubernetes Linux and 1 more

Products

Portal For Arcgis Kubernetes Linux Kernel and 1 more

CVE-2025-2538

BUG-000174336

A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2024-25709

Self-XSS style in move item dialog

There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScript code in a victim’s browser. Exploitation does not require any privileges and can be performed by an anonymous user.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Portal For Arcgis Linux Kernel Windows

CVE-2024-25705

Cross site scripting issue in embed widget

There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation requires basic authenticated access but does not require elevated or administrative privileges, indicating low privileges are required.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Portal For Arcgis Linux Kernel Windows

CVE-2024-25699

Portal for ArcGIS has an invalid authentication vulnerability

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker with low‑privileged access to compromise the confidentiality, integrity, and availability of the software. Successful exploitation allows the attacker to cross an authentication and authorization boundary beyond their originally assigned access, resulting in a scope change.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Esri Linux Microsoft

Products

Arcgis Enterprise Portal For Arcgis Linux Kernel and 1 more

CVE-2024-8149

BUG-000168624 - Unvalidated redirect in Portal for ArcGIS.

There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation is limited to the same browser execution context and does not result in a change of security scope beyond the affected user session.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2023-25837

BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.

There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2023-25835

BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability

There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configuration. When accessed by a victim, the stored payload may execute arbitrary JavaScript code in the victim’s browser. Successful exploitation could allow the attacker to access sensitive user data and session information, alter trusted site content and user actions, and disrupt normal site functionality, resulting in a high impact to confidentiality, integrity, and availability.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-4967

Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS

Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57879

BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57878

BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57877

Reflected XSS vulnerability in Portal for ArcGIS.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57876

Stored XSS vulnerability in Portal for ArcGIS

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57875

BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57874

BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS.  (11.3, 11.1, 10.9.1)

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57873

BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57872

BUG-000174150 - Unvalidated redirect in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-57871

BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-55107

BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis

CVE-2025-55103

BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Portal For Arcgis