CVE-2025-4967: Esri Portal For Arcgis

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.

Affected products

• Esri Portal For Arcgis: up to and including 11.4

Published 2025-05-29. Last modified 2026-06-17.