What is CVE-2026-69228?

CVE-2026-69228 is a medium-severity vulnerability in Esri Portal For Arcgis, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2026-08-21.

How severe is CVE-2026-69228?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Esri Portal For Arcgis

CVE-2026-69228

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Esri Portal For Arcgis

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

psirt@esri.com

Frequently asked questions

What is CVE-2026-69228?: CVE-2026-69228 is a medium-severity vulnerability in Esri Portal For Arcgis, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2026-08-21.
How severe is CVE-2026-69228?: Medium severity. CVSS v3 base score is 5.3 out of 10.