CVE-2021-29108: Esri Portal For Arcgis

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.

Affected products

• Esri Portal For Arcgis: up to and including 10.9

Published 2021-10-01. Last modified 2026-06-17.