What’s Vulnerable › Products

Esri Portal for ArcGIS vulnerabilities

91 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 36 published in the last 12 months.

Check whether your Esri Portal for ArcGIS version is affected

Latest Esri Portal for ArcGIS vulnerabilities

• CVE-2026-69227 — BUG-000187331 Portal for ArcGIS has a security vulnerability (CVSS 9.8)
• CVE-2026-69226 — Portal for ArcGIS has a security vulnerability (CVSS 6.5)
• CVE-2026-10759 — BUG-000171040 Portal for ArcGIS has a security vulnerability (CVSS 5.5)
• CVE-2026-69238 — HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 4.8)
• CVE-2026-69237 — HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 4.8)
• CVE-2026-69236 — stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 6.1)
• CVE-2026-69235 — stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 6.1)
• CVE-2026-69234 — reflected cross site scripting vulnerability in Esri Portal for ArcGIS (CVSS 6.1)
• CVE-2026-69233 — stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5)
• CVE-2026-69232 — stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5)
• CVE-2026-69231 — stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5)
• CVE-2026-69230 — stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 4.8)
• CVE-2026-69229 — HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 5.4)
• CVE-2026-69228 — missing authentication vulnerability in Esri Portal for ArcGIS (CVSS 5.3)
• CVE-2026-69225 — information disclosure vulnerability in Esri Portal for ArcGIS (CVSS 7.5)
• CVE-2026-69224 — information disclosure vulnerability in Esri Portal for ArcGIS (CVSS 7.5)
• CVE-2026-13020 — Weak Password Recovery Mechanism in Portal for ArcGIS (CVSS 9.8)
• CVE-2026-13019 — Missing Authentication (CVSS 9.8)
• CVE-2026-33519 — Incorrect privilege assignment in Portal for ArcGIS (CVSS 9.8)
• CVE-2026-33518 — Incorrect privilege assignment in Portal for ArcGIS (CVSS 7.2)
• CVE-2025-57879 — BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS. (CVSS 6.1)
• CVE-2025-57878 — BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect. (CVSS 6.1)
• CVE-2025-57877 — Reflected XSS vulnerability in Portal for ArcGIS. (CVSS 4.8)
• CVE-2025-57876 — Stored XSS vulnerability in Portal for ArcGIS (CVSS 4.8)
• CVE-2025-57875 — BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS. (CVSS 4.8)