Advisories · Technology

Esri Portal for ArcGIS.

Every CVE that names Esri Portal for ArcGIS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-69226 CVE record

CVSS 6.5 Medium

Portal for ArcGIS has a security vulnerability
- Esri Portal for ArcGIS
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-10759 CVE record

CVSS 5.5 Medium

BUG-000171040 Portal for ArcGIS has a security vulnerability
- Esri Portal for ArcGIS
- Other injection
Not analysed yet 13 Oct 2026
CVE-2026-69227 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

BUG-000187331 Portal for ArcGIS has a security vulnerability
- Esri Portal for ArcGIS
- Authentication bypass
Not analysed yet 13 Oct 2026
CVE-2026-69233 CVE record

CVSS 5.5 Medium

stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69234 CVE record

CVSS 6.1 Medium

reflected cross site scripting vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69235 CVE record

CVSS 6.1 Medium

stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69236 CVE record

CVSS 6.1 Medium

stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69237 CVE record

CVSS 3.8 Low

HTML injection vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69232 CVE record

CVSS 5.5 Medium

stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69231 CVE record

CVSS 5.5 Medium

stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69230 CVE record

CVSS 5.5 Medium

stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69229 CVE record

CVSS 5.4 Medium

HTML injection vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69228 CVE record

CVSS 5.3 Medium

missing authentication vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Authentication bypass
Not analysed yet 21 Aug 2026
CVE-2026-69225 CVE record

CVSS 5.9 Medium

information disclosure vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Information disclosure
Not analysed yet 21 Aug 2026
CVE-2026-69238 CVE record

CVSS 3.5 Low

HTML injection vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2026
CVE-2026-69224 CVE record

CVSS 5.9 Medium

information disclosure vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Information disclosure
Not analysed yet 21 Aug 2026
CVE-2026-13019 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing Authentication
- Esri Portal for ArcGIS
- CWE-640
Not analysed yet 7 Jul 2026
CVE-2026-13020 CVE record

CVSS 8.1 High

Weak Password Recovery Mechanism in Portal for ArcGIS
- Esri Portal for ArcGIS
- CWE-640
Not analysed yet 7 Jul 2026
CVE-2026-33519 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect privilege assignment in Portal for ArcGIS
- Esri Portal for ArcGIS
- Privilege escalation
Not analysed yet 21 Apr 2026
CVE-2026-33518 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect privilege assignment in Portal for ArcGIS
- Esri Portal for ArcGIS
- Privilege escalation
Not analysed yet 21 Apr 2026
CVE-2025-57871 CVE record

CVSS 4.8 Medium

BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 29 Sept 2025
CVE-2025-57872 CVE record

CVSS 6.1 Medium

BUG-000174150 - Unvalidated redirect in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Open redirect
Not analysed yet 29 Sept 2025
CVE-2025-57873 CVE record

CVSS 4.8 Medium

BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 29 Sept 2025
CVE-2025-57874 CVE record

CVSS 4.8 Medium

BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS. (11.3, 11.1, 10.9.1)
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 29 Sept 2025
CVE-2025-57875 CVE record

CVSS 4.8 Medium

BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 29 Sept 2025
CVE-2025-57877 CVE record

CVSS 4.8 Medium

Reflected XSS vulnerability in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 29 Sept 2025
CVE-2025-57878 CVE record

CVSS 6.1 Medium

BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.
- Esri Portal for ArcGIS
- Open redirect
Not analysed yet 29 Sept 2025
CVE-2025-57879 CVE record

CVSS 6.1 Medium

BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Open redirect
Not analysed yet 29 Sept 2025
CVE-2025-57876 CVE record

CVSS 4.8 Medium

Stored XSS vulnerability in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 29 Sept 2025
CVE-2025-4967 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS
- Esri Portal for ArcGIS
- Server-side request forgery (SSRF)
Not analysed yet 29 May 2025
CVE-2025-2538 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

BUG-000174336
- Esri Portal for ArcGIS
- Hard-coded credentials
Not analysed yet 20 Mar 2025
CVE-2024-38040 CVE record

CVSS 7.5 High

BUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerability
- Esri Portal for ArcGIS
- Path traversal
Not analysed yet 4 Oct 2024
CVE-2024-38038 CVE record

CVSS 6.1 Medium

BUG-000165732 - Reflected XSS in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Oct 2024
CVE-2024-25691 CVE record

CVSS 6.1 Medium

BUG-000165286 - Reflected XSS in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Oct 2024
CVE-2024-25707 CVE record

CVSS 4.8 Medium

BUG-000160241 - Reflected XSS in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Oct 2024
CVE-2024-8149 CVE record

CVSS 4.6 Medium

BUG-000168624 - Unvalidated redirect in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Oct 2024
CVE-2024-38039 CVE record

CVSS 5.4 Medium

BUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Oct 2024
CVE-2024-8148 CVE record

CVSS 6.1 Medium

BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)
- Esri Portal for ArcGIS
- Open redirect
Not analysed yet 4 Oct 2024
CVE-2024-38037 CVE record

CVSS 6.1 Medium

BUG-000167983 - Unvalidated redirect in Portal for ArcGIS
- Esri Portal for ArcGIS
- Open redirect
Not analysed yet 4 Oct 2024
CVE-2024-25699 CVE record

CVSS 8.5 High

Portal for ArcGIS has an invalid authentication vulnerability
- Esri Portal for ArcGIS
- Authentication bypass
Not analysed yet 4 Apr 2024
CVE-2024-25705 CVE record

CVSS 5.4 Medium

Cross site scripting issue in embed widget
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2024
CVE-2024-25706 CVE record

CVSS 6.1 Medium

HTMLi at createFolder Content Injection
- Esri Portal for ArcGIS
- Code injection
Not analysed yet 4 Apr 2024
CVE-2024-25709 CVE record

CVSS 6.1 Medium

Self-XSS style in move item dialog
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2024
CVE-2024-25698 CVE record

CVSS 6.1 Medium

Reflected XSS in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2024
CVE-2024-25693 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Portal for ArcGIS has a directory traversal vulnerability.
- Esri Portal for ArcGIS
- Path traversal
Not analysed yet 4 Apr 2024
CVE-2024-25695 CVE record

CVSS 7.2 High

concatenated errors resulting in cross site scripting and frame injection issues.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2024
CVE-2024-25696 CVE record

CVSS 4.8 Medium

Stored XSS in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2024
CVE-2024-25697 CVE record

CVSS 5.4 Medium

Stored XSS in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2024
CVE-2024-25692 CVE record

CVSS 5.4 Medium

BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site request forgery (CSRF)
Not analysed yet 4 Apr 2024
CVE-2023-25833 CVE record

CVSS 5.4 Medium

BUG-000155004 HTML injection issue in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 10 May 2023
CVE-2023-25831 CVE record

CVSS 6.1 Medium

BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 9 May 2023
CVE-2023-25830 CVE record

CVSS 6.1 Medium

BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 9 May 2023
CVE-2023-25829 CVE record

CVSS 6.1 Medium

BUG-000155001 - Unvalidated redirect in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Open redirect
Not analysed yet 9 May 2023
CVE-2023-25834 CVE record

CVSS 5.4 Medium

BUG-000142922 Incomplete permission changes in specific cases.
- Esri Portal for ArcGIS
- Privilege escalation
Not analysed yet 9 May 2023
CVE-2023-25832 CVE record

CVSS 8.8 High

BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS.
- Esri Portal for ArcGIS
- Cross-site request forgery (CSRF)
Not analysed yet 9 May 2023
CVE-2022-38203 CVE record

CVSS 7.5 High

The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)
- Esri Portal for ArcGIS
- Server-side request forgery (SSRF)
Not analysed yet 30 Dec 2022
CVE-2022-38189 CVE record

CVSS 5.4 Medium

There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 16 Aug 2022
CVE-2022-38184 CVE record

CVSS 7.5 High

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1
- Esri Portal for ArcGIS
- Broken access control
Not analysed yet 16 Aug 2022
CVE-2022-38192 CVE record

CVSS 6.1 Medium

There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
Not analysed yet 16 Aug 2022
CVE-2022-38193 CVE record

CVSS 6.1 Medium

Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)
- Esri Portal for ArcGIS
- Code injection
Not analysed yet 16 Aug 2022