EsriCVE-2026-69228
Esri Portal for ArcGIS: missing authentication
Medium5.3CVE-2026-69228 · Published Aug 21, 2026 · updated Sep 11, 2026
There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Portal for ArcGIS Product | >= 11.1, <= 12.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-306
More Esri advisories
All Esri| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 21 | Esri Portal for ArcGIS: cross-site scripting | Medium5.5 | No fix yet |
| Aug 21 | Esri Portal for ArcGIS: cross-site scripting | Medium6.1 | No fix yet |
| Aug 21 | Esri Portal for ArcGIS: cross-site scripting | Medium6.1 | No fix yet |
| Aug 21 | Esri Portal for ArcGIS: cross-site scripting | Medium6.1 | No fix yet |
| Aug 21 | Esri Portal for ArcGIS: cross-site scripting | Low3.8 | No fix yet |
| Aug 21 | Esri Portal for ArcGIS: cross-site scripting | Low3.5 | No fix yet |