Esri vulnerabilities and threats

CVE-2026-69226 is a medium severity vulnerability in Esri Portal for ArcGIS that allows unauthenticated users to create new accounts via the sharing endpoint even when self-service account registration is disabled. This occurs due to an incorrect authorization flaw (CWE-863) that lets attackers bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.

CVE-2026-10759 is an LDAP injection vulnerability in Esri Portal for ArcGIS that affects versions up to and including 12.2. It allows an authenticated administrator to supply crafted input through administrative functions that construct LDAP or Active Directory queries without proper input neutralization. This can modify the intended LDAP query, leading to unintended directory operations. The vulnerability has a medium severity with a CVSS score of 5.5.

CVE-2026-69227 is a critical vulnerability in Esri Portal for ArcGIS that allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This missing authentication flaw could enable attackers to perform administrative functions without proper credentials, potentially leading to full compromise of the portal. The vulnerability affects versions from 11.1 through 12.1 inclusive. It has a CVSS 3.1 base score of 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

CVE-2026-10758 is a high-severity vulnerability in Esri LERC, an open-source image/raster format library. It involves an integer overflow or wraparound leading to a heap-based out-of-bounds write. This flaw affects LERC versions 0 through 4.1.0 and earlier. A remote, unauthenticated attacker can exploit this by supplying crafted imagery to cause an application crash, resulting in denial of service. No confidentiality or integrity impact is reported. No patch information is currently available.

CVE-2026-69233 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 through 11.5. It allows a remote attacker with administrative privileges to inject malicious code that could execute in the browsers of other users. The vulnerability affects versions 11.1, 11.3, and 11.5, and users are advised to upgrade to the latest long-term support release.

CVE-2026-69234 is a reflected cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 through 11.5. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a user, could execute arbitrary JavaScript in the victim's browser. The vulnerability affects Portal for ArcGIS and users of ArcGIS Web App Builder developer edition, which is unsupported. Users are advised to patch affected versions or upgrade to the latest long-term support release. No known exploits are reported in the wild.

CVE-2026-69235 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. It allows a remote, privileged attacker to inject malicious code that could execute in the browser of a victim. The vulnerability affects versions 11.1, 11.3, and 11.5 specifically. Users are advised to patch or upgrade to the latest long-term support release to mitigate the risk.

CVE-2026-69236 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 through 12.1. This flaw allows a remote, privileged attacker to inject malicious JavaScript code that could execute in the browsers of other users. The vulnerability affects multiple versions of ArcGIS Enterprise, and users are advised to upgrade to the latest long-term support release and apply the patch.

CVE-2026-69237 is a low-severity HTML injection vulnerability (CWE-79) in Esri Portal for ArcGIS versions 11.1 through 11.3. It allows a remote attacker with administrative privileges to inject arbitrary HTML into an administrative API. This vulnerability affects the web page generation process and could lead to limited confidentiality and integrity impacts. Users of ArcGIS Enterprise 11.1 and 11.3 are advised to patch, and all users should upgrade to the latest long-term support release.

CVE-2026-69232 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 through 11.5. It allows a remote, privileged attacker to inject malicious JavaScript code that could execute in the browsers of users interacting with the affected portal. This vulnerability has a medium severity rating with a CVSS score of 5.5. Users of ArcGIS Enterprise versions 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release to mitigate the risk.

CVE-2026-69231 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. It allows a remote, privileged attacker to inject malicious JavaScript code that could execute in the browsers of other users. The vulnerability affects versions 11.1 through 11.5, with a medium severity rating and a CVSS score of 5.5. Users of ArcGIS Enterprise 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release to mitigate the risk.

CVE-2026-69230 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.5 and earlier. It allows a remote attacker with administrative privileges to inject malicious code that could execute in the browsers of other users. The vulnerability affects versions from 11.1 through 11.5. Users of ArcGIS Enterprise 11.1, 11.3, and 11.5 are advised to apply patches or upgrade to the latest long-term support release.

CVE-2026-69229 is a medium severity cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 through 12.0. It allows a remote, authenticated attacker to inject arbitrary HTML into the Portal for ArcGIS Home application. This vulnerability affects multiple versions of ArcGIS Enterprise, and users are advised to upgrade to the latest long-term support release.

CVE-2026-69228 is a medium severity vulnerability in Esri Portal for ArcGIS versions 11.1 through 12.0. It involves missing authentication for a critical function, allowing remote unauthenticated attackers to access a specific resource that should be restricted to authenticated users. The vulnerability does not affect user content and does not impact integrity or availability. Users are advised to patch or upgrade to the latest long-term support release.

CVE-2026-69225 is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier. It allows a remote, unauthenticated attacker to cause sensitive information to be reflected in an HTTP response body. The vulnerability is classified under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS v3.1 base score is 5.9, reflecting a medium severity level.

CVE-2026-69238 is a low-severity cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 through 11.5. It allows a remote attacker with high privileges to inject arbitrary HTML into the Portal for ArcGIS Home application. This vulnerability affects versions from 11.1 up to and including 11.5. Users are advised to patch or upgrade to the latest long-term support release to mitigate the issue.

CVE-2026-69224 is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.1 through 12.0. Under difficult to reproduce conditions, a remote unauthenticated attacker may cause sensitive information to be reflected in an HTTP response body. The vulnerability has a medium severity rating with a CVSS score of 5.9.

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability.

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.