CVE-2026-69228: Esri Portal For Arcgis

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Affected products

• Esri Portal For Arcgis: before 11.1 (fixed in 11.1); version 11.1 only; version 11.2 only; version 11.3 only; version 11.4 only; version 11.5 only; …

Published 2026-08-21. Last modified 2026-09-11.