CVE-2026-69228CWE-306

CVE-2026-69228

Medium · published August 22, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00484 · 40.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-22T01:17Z
Affected products (21)
ProductVersionsFixed in
esri/portal_for_arcgis< 11.111.1
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
esri/portal_for_arcgisall versions—
References (1)
https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin · [email protected]
EPSS history
Timeline
  • 21 AUG 20:48Z
    missing authentication vulnerability in Esri Portal for ArcGIS
    cvelistv5