CVE-2025-57879: Esri Portal for ArcGIS Redirect Vulnerability

CVE-2025-57879 Overview

CVE-2025-57879 is an unvalidated redirect vulnerability affecting Esri Portal for ArcGIS versions 11.4 and below. A remote, unauthenticated attacker can craft a URL that redirects a victim to an arbitrary external website. The flaw maps to CWE-601: URL Redirection to Untrusted Site, commonly known as an Open Redirect. Attackers typically weaponize this class of issue to lend legitimacy to phishing campaigns because the initial URL points to a trusted Esri Portal domain before redirecting to attacker-controlled infrastructure. Successful exploitation requires user interaction, but no authentication is needed. Esri addressed the issue in the Portal for ArcGIS Security 2025 Update 3 patch.

Critical Impact
Attackers can abuse the trusted ArcGIS Portal domain to redirect users to phishing sites, harvesting credentials or delivering malware while bypassing URL reputation controls.

Affected Products

Esri Portal for ArcGIS 10.9.1 (including Security 2025 Update 1 and Update 2)
Esri Portal for ArcGIS 11.0, 11.1, 11.2, 11.3 (all patch levels through Security 2025 Update 2)
Esri Portal for ArcGIS 11.4 (including Security 2025 Update 1 and Update 2)

Discovery Timeline

2025-09-29 - CVE-2025-57879 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57879

Vulnerability Analysis

CVE-2025-57879 is an Open Redirect vulnerability [CWE-601] in the Esri Portal for ArcGIS web interface. The application accepts a user-controlled destination parameter and issues an HTTP redirect without validating that the target belongs to an allow-list of trusted hosts. Because the initial request originates from the legitimate Portal for ArcGIS domain, users and secure email gateways often treat the link as safe. The scope-change component reflects that the trust boundary of the Portal application is crossed when the browser navigates to the attacker-controlled origin.

Root Cause

The root cause is missing or insufficient validation of a redirect target URL supplied through a request parameter. The redirect handler does not enforce that the destination hostname matches the Portal's own domain or an administrator-defined allow-list. Any absolute URL provided by the attacker is accepted and returned in a Location header or client-side navigation instruction.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker crafts a URL that references a legitimate Portal for ArcGIS endpoint but embeds an attacker-controlled destination in the redirect parameter. The victim clicks the link, typically delivered by email, chat, or a compromised page. The Portal server responds with a redirect, and the browser navigates to the attacker's site, which commonly mimics the ArcGIS or corporate single sign-on login page to harvest credentials.

No verified proof-of-concept code is publicly available. Refer to the Esri Portal for ArcGIS Security 2025 Update 3 Patch advisory for authoritative technical details.

Detection Methods for CVE-2025-57879

Indicators of Compromise

Web server access logs showing requests to Portal for ArcGIS endpoints containing external URLs, IP addresses, or encoded protocol schemes in redirect-related query parameters.
Outbound HTTP 302 or 303 responses from the Portal host whose Location header points to a hostname outside the organization's approved domain list.
Referrer telemetry showing user navigation from the Portal domain directly to unfamiliar external domains shortly after clicking an emailed link.

Detection Strategies

Parse Portal for ArcGIS access logs for query parameters commonly used in redirects (for example url=, next=, returnUrl=, redirect=) and alert when the value contains an absolute URL to an untrusted host.
Correlate email gateway telemetry with web proxy logs to identify phishing messages that reference Esri Portal URLs with suspicious redirect parameters.
Deploy URL-inspection rules on secure web gateways that inspect the full querystring of Portal for ArcGIS links, not only the base domain.

Monitoring Recommendations

Continuously monitor the Portal for ArcGIS installation for the current patch level and flag hosts still on version 11.4 or below prior to Security 2025 Update 3.
Alert on spikes of 3xx responses issued by Portal servers, especially those redirecting to newly registered or low-reputation domains.
Track user reports of unexpected login prompts after clicking Portal links, which frequently indicate an open-redirect-driven phishing chain.

How to Mitigate CVE-2025-57879

Immediate Actions Required

Apply the Portal for ArcGIS Security 2025 Update 3 patch to all affected deployments as documented by Esri.
Inventory every Portal for ArcGIS instance, including internet-exposed and internal deployments, and confirm the installed version and patch level.
Notify users that legitimate ArcGIS Portal links will not redirect to third-party domains for authentication, reducing the success rate of phishing follow-ons.

Patch Information

Esri released the fix in the Portal for ArcGIS Security 2025 Update 3 patch. Installation instructions and download links are available in the Esri Portal for ArcGIS Security 2025 Update 3 Patch advisory. The patch covers supported versions from 10.9.1 through 11.4.

Workarounds

Place the Portal for ArcGIS web interface behind a reverse proxy or Web Application Firewall (WAF) rule that rejects requests where redirect parameters contain absolute URLs to external hosts.
Restrict Portal for ArcGIS access to authenticated corporate users via VPN or Zero Trust Network Access until the patch can be deployed.
Add user-awareness banners and email gateway rules that flag Portal URLs containing suspicious redirect query parameters.

bash

# Example WAF rule (ModSecurity) to block external redirect targets in Portal URLs
SecRule REQUEST_URI "@rx (?i)(redirect|returnurl|url|next)=https?%3A%2F%2F([^/]+)" \
  "id:1057879,phase:1,deny,status:400,\
   msg:'Blocked potential CVE-2025-57879 open redirect against Portal for ArcGIS',\
   chain"
  SecRule TX:2 "!@endsWith portal.example.com"