CVE-2026-69225: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Esri Portal for ArcGIS

This vulnerability in Esri Portal for ArcGIS (versions 11.5 through 12.0 and earlier) involves the exposure of sensitive information through HTTP response reflection. An unauthenticated remote attacker may exploit this flaw to obtain sensitive data that should not be disclosed. The vulnerability is identified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 score of 5.9 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, and high impact on confidentiality.

The vulnerability allows unauthorized remote attackers to access sensitive information by reflecting it in HTTP response bodies. This could lead to exposure of confidential data, potentially compromising privacy or security of the affected system. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor Esri's advisories and consider limiting exposure of affected versions to untrusted networks.