PF
Product
Portal for ArcGIS
91
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 8High 16Medium 67Low 0
Watch
Add Portal for ArcGIS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-25693 | 9.9 | Apr 4 | Portal for ArcGIS has a directory traversal vulnerability. Affected: all through <=11.2 |
| CVE-2026-69227 | 9.8 | Oct 13 | BUG-000187331 Portal for ArcGIS has a security vulnerability Affected: 11.1 through 12.1 |
| CVE-2026-13019 | 9.8 | Jul 7 | Missing Authentication Affected: before 12.1 |
| CVE-2026-13020 | 9.8 | Jul 7 | Weak Password Recovery Mechanism in Portal for ArcGIS Affected: before 12.1 |
| CVE-2026-33519 | 9.8 | Apr 21 | Incorrect privilege assignment in Portal for ArcGIS Affected: 11.4; 11.5; 12.0 |
| CVE-2025-2538 | 9.8 | Mar 20 | BUG-000174336 Affected: All through 11.4 |
| CVE-2022-38193 | 9.6 | Aug 16 | Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1) Affected: 10.7.1 10.8.1 |
| CVE-2025-4967 | 9.1 | May 29 | Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS Affected: through 11.4 |
| CVE-2023-25832 | 8.8 | May 9 | BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS. Affected: All through 11.0 |
| CVE-2021-29108 | 8.8 | Oct 1 | There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker… Affected: through 10.9 |
| CVE-2024-25699 | 8.5 | Apr 4 | Portal for ArcGIS has an invalid authentication vulnerability Affected: all through <= 11.2 |
| CVE-2023-25837 | 8.4 | Jul 21 | BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS. Affected: 10.8.1 through 10.9 |
| CVE-2023-25835 | 8.4 | Jul 20 | BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability Affected: 10.8.1 through 11.1 |
| CVE-2026-69225 | 7.5 | Aug 21 | information disclosure vulnerability in Esri Portal for ArcGIS Affected: 11.5 through 12.0 |
| CVE-2026-69224 | 7.5 | Aug 21 | information disclosure vulnerability in Esri Portal for ArcGIS Affected: 11.1 through 12.0 |
| CVE-2024-38040 | 7.5 | Oct 4 | BUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerability Affected: All through 11.2 |
| CVE-2022-38212 | 7.5 | Dec 29 | Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) Affected: through 10.8.1 |
| CVE-2022-38211 | 7.5 | Dec 29 | Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only) Affected: through 10.9.1 |
| CVE-2022-38205 | 7.5 | Dec 29 | Portal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only) Affected: through 10.9.1 |
| CVE-2022-38203 | 7.5 | Dec 29 | The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only) Affected: Portal for ArcGIS 10.7.1 and 10.8.1 |
| CVE-2022-38184 | 7.5 | Aug 16 | There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 Affected: All through 10.8.1 |
| CVE-2022-38187 | 7.5 | Aug 15 | Prevent access to sharing/rest/content/features/analyze to unauthorized users Affected: All through 10.8.1 |
| CVE-2026-33518 | 7.2 | Apr 21 | Incorrect privilege assignment in Portal for ArcGIS Affected: 11.5 |
| CVE-2024-25695 | 7.2 | Apr 4 | concatenated errors resulting in cross site scripting and frame injection issues. Affected: all through 11.2 |
| CVE-2026-69226 | 6.5 | Oct 13 | Portal for ArcGIS has a security vulnerability Affected: through 12.2 |
| CVE-2026-69234 | 6.1 | Aug 21 | reflected cross site scripting vulnerability in Esri Portal for ArcGIS Affected: 11.1 through 11.5 |
| CVE-2026-69235 | 6.1 | Aug 21 | stored cross site scripting issue in Esri Portal for ArcGIS Affected: 11.1 through 11.5 |
| CVE-2026-69236 | 6.1 | Aug 21 | stored cross site scripting issue in Esri Portal for ArcGIS Affected: 11.1 through 12.1 |
| CVE-2025-57872 | 6.1 | Sep 29 | BUG-000174150 - Unvalidated redirect in Portal for ArcGIS. Affected: 10.9.1 through 11.4 |
| CVE-2025-57878 | 6.1 | Sep 29 | BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect. Affected: 10.9.1 through 11.4 |
| CVE-2025-57879 | 6.1 | Sep 29 | BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS. Affected: 10.9.1 through 11.4 |
| CVE-2024-38038 | 6.1 | Oct 4 | BUG-000165732 - Reflected XSS in Portal for ArcGIS Affected: all through 11.1 |
| CVE-2024-25691 | 6.1 | Oct 4 | BUG-000165286 - Reflected XSS in Portal for ArcGIS Affected: all through 11.2 |
| CVE-2024-8148 | 6.1 | Oct 4 | BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1) Affected: all through 11.2 |
| CVE-2024-38037 | 6.1 | Oct 4 | BUG-000167983 - Unvalidated redirect in Portal for ArcGIS Affected: all through 11.1 |
| CVE-2024-25706 | 6.1 | Apr 4 | HTMLi at createFolder Content Injection Affected: All through <=11.0 |
| CVE-2024-25709 | 6.1 | Apr 4 | Self-XSS style in move item dialog Affected: All through 11.2 |
| CVE-2024-25698 | 6.1 | Apr 4 | Reflected XSS in Portal for ArcGIS Affected: all through 11.1 |
| CVE-2023-25831 | 6.1 | May 9 | BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS. Affected: All through 10.9.1 |
| CVE-2023-25830 | 6.1 | May 9 | BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS Affected: all through 10.9.1 |
| CVE-2023-25829 | 6.1 | May 9 | BUG-000155001 - Unvalidated redirect in Portal for ArcGIS. Affected: all through 11.0 |
| CVE-2022-38210 | 6.1 | Dec 29 | HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only) Affected: through 10.9.1 |
| CVE-2022-38209 | 6.1 | Dec 29 | Reflected XSS vulnerability in Portal for ArcGIS Affected: through 10.9.1 |
| CVE-2022-38208 | 6.1 | Dec 29 | Unvalidated redirect in Portal for ArcGIS Affected: through 11.0 |
| CVE-2022-38207 | 6.1 | Dec 29 | Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) Affected: 10.7.1; 10.8.1 |
| CVE-2022-38206 | 6.1 | Dec 29 | Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only) Affected: through 10.9.1 |
| CVE-2022-38204 | 6.1 | Dec 29 | Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) Affected: 10.7.1; 10.8.1 |
| CVE-2022-38188 | 6.1 | Aug 15 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could… Affected: 10.9.1 |
| CVE-2022-38190 | 6.1 | Aug 15 | Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps Affected: all through 10.8.1 |
| CVE-2022-38186 | 6.1 | Aug 15 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link… Affected: 10.8.1 through All |