CVE-2024-38040: Esri Portal For Arcgis

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.

Affected products

• Esri Portal For Arcgis: version 10.9.1 only; version 11.0 only; version 11.1 only; version 11.2 only

Published 2024-10-04. Last modified 2026-06-17.