Esri Portal For Arcgis vulnerabilities

91 vulnerabilities

Known vulnerabilities in Esri Portal For Arcgis, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CriticalCVE-2026-69227esri · portal_for_arcgisBUG-000187331 Portal for ArcGIS has a security vulnerabilityA flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.EPSS0.33%6.5MediumCVE-2026-69226esri · portal_for_arcgisPortal for ArcGIS has a security vulnerabilityA flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.EPSS0.18%5.5MediumCVE-2026-10759esri · portal_for_arcgisBUG-000171040 Portal for ArcGIS has a security vulnerabilityA flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.EPSS0.25%6.1MediumCVE-2021-29109esri · portal_for_arcgisA reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.EPSS0.74%8.8HighCVE-2021-29108esri · portal_for_arcgisThere is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.EPSS0.81%5.4MediumCVE-2021-29110esri · portal_for_arcgisStored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.EPSS0.66%9.8CriticalCVE-2025-2538esri · portal_for_arcgisBUG-000174336A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.EPSS0.56%4.8MediumCVE-2025-55106esri · portal_for_arcgis +1 moreBUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%4.8MediumCVE-2025-55105esri · portal_for_arcgis +1 moreBUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%4.8MediumCVE-2025-55104esri · portal_for_arcgis +1 moreBUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user attacker supplied JavaScript may execute in the victim's browser.EPSS0.19%4.8MediumCVE-2025-55103esri · portal_for_arcgis +1 moreBUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%4.8MediumCVE-2025-55107esri · portal_for_arcgis +1 moreBUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%9.1CriticalCVE-2025-4967esri · portal_for_arcgisServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGISEsri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.EPSS0.58%4.8MediumCVE-2025-57875esri · portal_for_arcgisBUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%4.8MediumCVE-2025-57871esri · portal_for_arcgisBUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%6.1MediumCVE-2025-57872esri · portal_for_arcgisBUG-000174150 - Unvalidated redirect in Portal for ArcGIS.There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.EPSS0.25%6.1MediumCVE-2025-57879esri · portal_for_arcgisBUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.EPSS0.25%4.8MediumCVE-2025-57877esri · portal_for_arcgisReflected XSS vulnerability in Portal for ArcGIS.There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%4.8MediumCVE-2025-57874esri · portal_for_arcgisBUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS.  (11.3, 11.1, 10.9.1)There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%6.1MediumCVE-2025-57878esri · portal_for_arcgisBUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.EPSS0.25%