Esri Portal For Arcgis vulnerabilities, page 4

91 vulnerabilities

Known vulnerabilities in Esri Portal For Arcgis, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1MediumCVE-2024-38037esri · portal_for_arcgisBUG-000167983 - Unvalidated redirect in Portal for ArcGISThere is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.EPSS0.32%7.5HighCVE-2024-38040esri · portal_for_arcgisBUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerabilityThere is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.EPSS0.48%5.4MediumCVE-2024-38039esri · portal_for_arcgisBUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).EPSS0.29%4.6MediumCVE-2024-8149esri · portal_for_arcgisBUG-000168624 - Unvalidated redirect in Portal for ArcGIS.There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation is limited to the same browser execution context and does not result in a change of security scope beyond the affected user session.EPSS0.42%6.1MediumCVE-2024-8148esri · portal_for_arcgisBUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.EPSS0.32%9.8CriticalCVE-2026-13019esri · portal_for_arcgisMissing AuthenticationEsri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability.EPSS0.85%9.8CriticalCVE-2026-13020esri · portal_for_arcgisWeak Password Recovery Mechanism in Portal for ArcGISA Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.EPSS0.47%4.8MediumCVE-2026-69238esri · portal_for_arcgisHTML injection vulnerability in Esri Portal for ArcGISThere is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.24%4.8MediumCVE-2026-69237esri · portal_for_arcgisHTML injection vulnerability in Esri Portal for ArcGISThere is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.29%5.5MediumCVE-2026-69233esri · portal_for_arcgisstored cross site scripting issue in Esri Portal for ArcGISThere is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.27%6.1MediumCVE-2026-69234esri · portal_for_arcgisreflected cross site scripting vulnerability in Esri Portal for ArcGISThere is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. Users working with ArcGIS Web App Builder developer edition are advised to migrate to ArcGIS Experience Builder, as ArcGIS Web App Builder developer edition is unsupported when this CVE is assigned.EPSS0.34%6.1MediumCVE-2026-69236esri · portal_for_arcgisstored cross site scripting issue in Esri Portal for ArcGISThere is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encouraged to patch. All users are advised to upgrade to the latest long-term support release and apply the patch.EPSS0.30%5.3MediumCVE-2026-69228esri · portal_for_arcgismissing authentication vulnerability in Esri Portal for ArcGISThere is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.48%5.4MediumCVE-2026-69229esri · portal_for_arcgisHTML injection vulnerability in Esri Portal for ArcGISThere is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.27%7.5HighCVE-2026-69224esri · portal_for_arcgisinformation disclosure vulnerability in Esri Portal for ArcGISThere is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.EPSS0.46%7.5HighCVE-2026-69225esri · portal_for_arcgisinformation disclosure vulnerability in Esri Portal for ArcGISThere is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.EPSS0.46%5.5MediumCVE-2026-69230esri · portal_for_arcgisstored cross site scripting issue in Esri Portal for ArcGISThere is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.24%5.5MediumCVE-2026-69232esri · portal_for_arcgisstored cross site scripting issue in Esri Portal for ArcGISThere is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.33%5.5MediumCVE-2026-69231esri · portal_for_arcgisstored cross site scripting issue in Esri Portal for ArcGISThere is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.33%6.1MediumCVE-2026-69235esri · portal_for_arcgisstored cross site scripting issue in Esri Portal for ArcGISThere is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.EPSS0.30%