CVE-2022-38184: Esri Portal For Arcgis

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.

Affected products

• Esri Portal For Arcgis: up to and including 10.8.1

Published 2022-08-16. Last modified 2026-06-17.