CVE-2026-69228

Published: Aug 21, 2026Modified: Oct 12, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: psirt@esri.com (Secondary)

Description

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Affected (21)

Products: Esri: Portal For Arcgis

Esri

1 product

Portal For Arcgis

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Esri Portal For Arcgis	version < 11.1
Esri Portal For Arcgis	Version 11.1
Esri Portal For Arcgis	Version 11.1 security_2024_update1
Esri Portal For Arcgis	Version 11.1 security_2024_update2
Esri Portal For Arcgis	Version 11.1 security_2025_update1
Esri Portal For Arcgis	Version 11.1 security_2025_update2
Esri Portal For Arcgis	Version 11.1 security_2025_update3
Esri Portal For Arcgis	Version 11.1 security_2026_update2
Esri Portal For Arcgis	Version 11.2
Esri Portal For Arcgis	Version 11.3
Esri Portal For Arcgis	Version 11.3 security_2025_update1
Esri Portal For Arcgis	Version 11.3 security_2025_update2
Esri Portal For Arcgis	Version 11.3 security_2025_update3
Esri Portal For Arcgis	Version 11.3 security_2026_update2
Esri Portal For Arcgis	Version 11.4
Esri Portal For Arcgis	Version 11.5
Esri Portal For Arcgis	Version 11.5 security_2026_update1
Esri Portal For Arcgis	Version 11.5 security_2026_update2
Esri Portal For Arcgis	Version 12.0
Esri Portal For Arcgis	Version 12.0 security_2026_update1
Esri Portal For Arcgis	Version 12.0 security_2026_update2

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin

Source: psirt@esri.com

Vendor Advisory

Timeline

No history available yet.