CVE-2026-69225 Esri CVE debrief

Who should care

Organizations using Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier should review and verify their systems for potential information disclosure vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact of this vulnerability on their environments and take necessary actions to protect their systems. Additionally, security teams should monitor for suspicious activity and implement compensating controls if necessary. IT teams responsible for maintaining Esri Portal for ArcGIS should prioritize patching and verifying the systems to prevent potential exploitation. Furthermore, asset inventory managers should ensure that all instances of Esri Portal for ArcGIS are accounted for and prioritized for remediation based on their criticality and exposure. This vulnerability may impact various stakeholders, including system administrators, cybersecurity professionals, and organizational leadership, who should work together to mitigate the risk effectively. The priority for defensive review is medium due to the potential for information disclosure, and organizations should focus on verifying vendor remediation, applying patches if available, and enhancing monitoring and detection capabilities to identify potential exploitation attempts.

Technical summary

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body. The vulnerability can be exploited by an attacker to gain sensitive information about the affected systems. Organizations should review and verify their systems for potential information disclosure vulnerability. This includes reviewing the configuration and settings of Esri Portal for ArcGIS, verifying the version and patch level, and assessing the potential impact of the vulnerability on their environments.

Defensive priority

Medium-priority defensive review recommended due to potential information disclosure vulnerability in Esri Portal for ArcGIS.

Recommended defensive actions

• Review Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier for potential information disclosure vulnerability
• Verify vendor remediation and apply patches if available
• Monitor for suspicious activity and implement compensating controls if necessary

Evidence notes

The evidence for this CVE is limited. The CVE record was published on 2026-08-21T21:17:03.300Z and has not been modified since then. The information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier may allow a remote, unauthenticated attacker to reflect sensitive information in an HTTP response body. Defenders should verify Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier for potential information disclosure vulnerability. The source details are limited, and additional verification is required.

Official resources