CVE-2026-69224: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Esri Portal for ArcGIS

This vulnerability (CWE-200) affects Esri Portal for ArcGIS versions from 11.1 up to and including 12.0. It allows a remote, unauthenticated attacker to potentially cause sensitive information to be reflected in HTTP response bodies. The conditions to trigger this information disclosure are difficult to reproduce, indicating a low likelihood of exploitation. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact.

Sensitive information may be exposed to unauthorized remote attackers without authentication. This could lead to confidentiality breaches but does not affect integrity or availability of the system. The difficulty in reproducing the issue suggests limited exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor Esri advisories for updates and apply patches once available.