CVE-2026-69225

Received Received - Intake

Information Disclosure in Esri Portal for ArcGIS

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Environmental Systems Research Institute, Inc.

Description

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-69225

EUVD

EUVD-2026-64154

Affected Vendors & Products

Vendor	Product	Version / Range
esri	portal_for_arcgis	From 11.5 (inc) to 12.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is an information disclosure issue in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier. It allows a remote, unauthenticated attacker to reflect sensitive information in an HTTP response body.

Detection Guidance

This vulnerability involves information disclosure in Esri Portal for ArcGIS. Detection may require checking HTTP responses for sensitive data leaks. Review server logs for unusual data reflections in responses. Use tools like curl to inspect HTTP headers and bodies for exposed information. Example: curl -v http://<target>/<endpoint> to check responses.

Impact Analysis

An attacker could exploit this to access sensitive data that should not be exposed, potentially leading to data breaches or unauthorized information retrieval.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to unauthorized disclosure of sensitive information, potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Update Esri Portal for ArcGIS to a version beyond 12.0 to address the information disclosure vulnerability. If immediate update is not possible, restrict network access to the affected system and monitor HTTP responses for sensitive data leaks.

Hi! I’m here to help you understand CVE-2026-69225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70