CVE-2026-69225

Published: Aug 21, 2026Modified: Oct 12, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

Affected (6)

Products: Esri: Portal For Arcgis

Esri

1 product

Portal For Arcgis

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Esri Portal For Arcgis	Version 11.5
Esri Portal For Arcgis	Version 11.5 security_2026_update1
Esri Portal For Arcgis	Version 11.5 security_2026_update2
Esri Portal For Arcgis	Version 12.0
Esri Portal For Arcgis	Version 12.0 security_2026_update1
Esri Portal For Arcgis	Version 12.0 security_2026_update2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin

Source: psirt@esri.com

Vendor Advisory

Timeline

No history available yet.