CVE-2026-69228

{"id": "CVE-2026-69228", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69228", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T12:45:14.313659Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@esri.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@esri.com", "affectedData": [{"vendor": "Esri", "product": "Portal for ArcGIS", "versions": [{"status": "affected", "version": "11.1", "versionType": "custom", "lessThanOrEqual": "12.0"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T21:17:03.423", "references": [{"url": "https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin", "tags": ["Vendor Advisory"], "source": "psirt@esri.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@esri.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release."}, {"lang": "es", "value": "Hay una vulnerabilidad de autenticaci\u00f3n faltante en Esri Portal for ArcGIS versiones 12.0 y anteriores que puede permitir a un atacante remoto no autenticado acceder a un recurso espec\u00edfico (no contenido de usuario) que solo deber\u00eda ser accesible por usuarios autenticados. Se anima a los usuarios que trabajan con ArcGIS Enterprise 11.1, 11.3, 11.5 o 12.0 a aplicar el parche. Se aconseja a todos los usuarios actualizar a la \u00faltima versi\u00f3n de soporte a largo plazo."}], "lastModified": "2026-10-12T16:10:00.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E58D508-AABB-4147-8C91-D3AD2F967A57", "versionEndExcluding": "11.1"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB18AD2D-85F6-4F7F-8579-08DC03BB4092"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2026_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79940776-2AEC-4547-B7E6-6068C40B3E9F"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2E37361-8569-4023-BC3E-F36E7607CC7D"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18EB24C5-1C1F-48C1-B2B1-B5D6F98D368D"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2026_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAF3B185-270A-4228-86C8-57D20C8EDF5B"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A3EFAC1-1347-4C8E-BBCB-413888139F33"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "595870AC-22E7-48D3-9C49-3917F9FC36F4"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.5:security_2026_update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B27FAC39-0BCB-44C9-843A-F7E191F0EC4A"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.5:security_2026_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13093BF8-653E-4838-A734-6A843088A22F"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:12.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "233E1A80-7F7D-44B3-A4A2-FA351741118A"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:12.0:security_2026_update1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "405FDE7A-D417-4DD4-96B0-DB3BC4E20934"}, {"criteria": "cpe:2.3:a:esri:portal_for_arcgis:12.0:security_2026_update2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76DA95E9-2109-4C29-B439-3FF902949AD4"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@esri.com"}