CVE-2026-69225: Esri Portal for ArcGIS Information Disclosure

CVE-2026-69225 Overview

CVE-2026-69225 is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier. A remote, unauthenticated attacker can trigger the flaw to reflect sensitive information in an HTTP response body. The weakness is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Esri disclosed the issue in the August 2026 ArcGIS Security Bulletin.

Critical Impact
Successful exploitation allows unauthenticated attackers to obtain sensitive information reflected in HTTP responses from vulnerable ArcGIS Portal deployments, which can support further reconnaissance or targeted attacks against enterprise GIS infrastructure.

Affected Products

Esri Portal for ArcGIS 11.5
Esri Portal for ArcGIS versions through 12.0
Earlier Esri Portal for ArcGIS releases as listed in the vendor bulletin

Discovery Timeline

2026-08-21 - CVE-2026-69225 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-69225

Vulnerability Analysis

The vulnerability resides in Esri Portal for ArcGIS, the web-facing component of ArcGIS Enterprise used to share maps, apps, and geospatial content. According to the vendor advisory, an unauthenticated attacker can craft a request that causes the server to reflect sensitive data in the HTTP response body. This class of flaw falls under information exposure ([CWE-200]).

Because the issue is reflective, an attacker does not need to hold valid credentials or persistent access to the target. The attack is network-reachable and requires no user interaction, though exploitation carries higher attack complexity based on the CVSS vector.

The disclosed data pertains to confidentiality only. Integrity and availability of the Portal service are not affected. However, disclosed content may include configuration details, tokens, or internal identifiers that assist follow-on attacks against ArcGIS Enterprise components.

Root Cause

The root cause is improper handling of input or response construction in Portal for ArcGIS, which allows sensitive server-side information to be embedded in HTTP responses returned to unauthenticated clients. Esri has not published the exact code paths involved. Refer to the Esri ArcGIS Security Bulletin for vendor-supplied technical detail.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to a reachable Portal for ArcGIS instance and parses the response body for reflected sensitive content. No authentication and no user interaction are required. Public-facing ArcGIS Portal deployments are the highest-risk targets.

No public proof-of-concept exploit or exploitation-in-the-wild reporting is available at the time of writing. Consult the vendor advisory for exact request patterns and remediated behavior.

Detection Methods for CVE-2026-69225

Indicators of Compromise

Unusual volumes of unauthenticated HTTP GET or POST requests to Portal for ArcGIS endpoints from a single source
HTTP responses to unauthenticated clients that contain internal identifiers, tokens, configuration paths, or user metadata
Repeated probing patterns targeting Portal REST or sharing API paths without corresponding session establishment

Detection Strategies

Inspect Portal for ArcGIS web server access logs for anomalous unauthenticated request patterns and response sizes
Deploy web application firewall (WAF) rules that flag responses containing sensitive keywords when returned to unauthenticated sessions
Correlate ArcGIS Portal telemetry with SIEM detections to surface reconnaissance behavior against GIS assets

Monitoring Recommendations

Enable verbose HTTP request and response logging on Portal for ArcGIS during triage windows
Baseline normal API traffic volumes and alert on deviations from unauthenticated clients
Monitor perimeter firewall and reverse proxy logs for spikes in traffic to /portal/sharing/rest and related paths

How to Mitigate CVE-2026-69225

Immediate Actions Required

Apply the security update referenced in the August 2026 Esri ArcGIS Security Bulletin to all Portal for ArcGIS instances at version 11.5 through 12.0 and earlier
Inventory internet-exposed Portal for ArcGIS deployments and prioritize them for patching
Rotate any tokens, API keys, or credentials that may have been reflected in unauthenticated responses during the exposure window

Patch Information

Esri has published fixed releases and mitigation guidance in the Esri ArcGIS Security Bulletin. Administrators should follow the vendor's upgrade path for their specific Portal for ArcGIS version.

Workarounds

Restrict Portal for ArcGIS access to trusted networks via firewall or reverse proxy allowlists until patching is complete
Place Portal for ArcGIS behind an authenticated reverse proxy to block unauthenticated request paths where feasible
Deploy WAF signatures that inspect outbound response bodies for sensitive strings and block matches to unauthenticated clients

bash

# Configuration example
# Refer to the Esri August 2026 ArcGIS Security Bulletin for
# vendor-supplied upgrade commands and configuration guidance:
# https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin