CVE-2026-69224: portal for arcgis 11.1, 11.2, 11.3 (+3 more affected versions); +1 more affected products

Affected technology

portal for arcgis · before 11.1 (exclusive)
esri

portal for arcgis · 11.1
esri

portal for arcgis · 11.1 · update security_2024_update1
esri

portal for arcgis · 11.1 · update security_2024_update2
esri

portal for arcgis · 11.1 · update security_2025_update1
esri

portal for arcgis · 11.1 · update security_2025_update2
esri

portal for arcgis · 11.1 · update security_2025_update3
esri

portal for arcgis · 11.1 · update security_2026_update2
esri

portal for arcgis · 11.2
esri

portal for arcgis · 11.3
esri

portal for arcgis · 11.3 · update security_2025_update1
esri

portal for arcgis · 11.3 · update security_2025_update2
esri

portal for arcgis · 11.3 · update security_2025_update3
esri

portal for arcgis · 11.3 · update security_2026_update2
esri

portal for arcgis · 11.4
esri

portal for arcgis · 11.5
esri

portal for arcgis · 11.5 · update security_2026_update1
esri

portal for arcgis · 11.5 · update security_2026_update2
esri

portal for arcgis · 12.0
esri

portal for arcgis · 12.0 · update security_2026_update1
esri

portal for arcgis · 12.0 · update security_2026_update2
esri

Portal for ArcGIS · 11.1 through 12.0
Esri

Description’s affected range: versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says there is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body. Vendor/CNA’s CVSS 3.1 assessment (base score 5.9/10) rates confidentiality impact as high; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none.