CVE-2026-69225: information disclosure vulnerability in Esri Portal for ArcGIS
Published Aug 21, 2026
·Updated
There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.
Affected Software
1 affected component
Esri Portal for ArcGIS>=11.5<12.0
Event History
Aug 21, 2026
CVE Published
via MITRE·08:46 PM
Data Sourced
via MITRE·08:46 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier are identified as affected.
2
Does exploitation require authentication or user interaction?
No. The vulnerability may be exploited remotely by an unauthenticated attacker and does not require user interaction.
3
What is the likely impact if exploitation succeeds?
Sensitive information may be reflected in an HTTP response body. The available information identifies confidentiality impact only; integrity and availability impact are listed as none.
4
How difficult is exploitation expected to be?
The attack complexity is rated high, indicating exploitation requires conditions beyond simply sending a basic network request.