Description

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T21:17:03.423Z",
  "pubdate": "2026-08-21T21:17:03.423Z",
  "executiveSummary": "A missing authentication vulnerability exists in Esri Portal for ArcGIS versions 12.0 and prior, potentially exposing specific system resources to unauthorized entities.\nThis vulnerability allows a remote, unauthenticated attacker to bypass access controls and interact directly with a designated resource within the affected deployment.\nThe flaw specifically affects Esri Portal for ArcGIS versions 12.0 and prior, with particular emphasis on deployments running ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0.\nThe risk implications include unauthorized access to sensitive application resources that are architecturally designed to require authenticated session validation.\nAttacker capabilities are limited to remote, unauthenticated interaction with the specific unprotected resource, as user content exposure is explicitly excluded from the affected scope.\nExploitation requirements include network connectivity to the vulnerable Esri Portal for ArcGIS endpoint and the absence of pre-existing authentication credentials on the attacker's side.\nOrganizations utilizing the vulnerable versions are strongly advised to apply available patches or upgrade to the latest long-term support release to ensure comprehensive protection against unauthorized resource access.",
  "technicalDetails": "The root cause of the vulnerability stems from a missing authentication check within the access control logic of Esri Portal for ArcGIS versions 12.0 and prior.\nThe vulnerable component fails to properly validate the session state or credentials of incoming HTTP requests attempting to access a specific internal resource.\nThe affected system exhibits improper authorization enforcement, allowing requests that should be restricted strictly to authenticated users to pass through without validation.\nThe attack vector involves network exposure where a remote, unauthenticated attacker sends a direct request over the network to the targeted resource endpoint.\nDuring the attack flow, the attacker initiates a standard network request targeting the specific resource URI exposed by the vulnerable Esri Portal instance.\nBecause the application logic lacks the necessary authentication enforcement mechanism at the routing or endpoint handler level, it processes the request and returns the resource data.\nAuthentication requirements are completely bypassed due to the flawed code path, meaning zero privileges or credentials are required by the threat actor.\nThe payload behavior is characterized by standard protocol requests sent directly to the exposed resource endpoint, requiring no complex exploit payload or memory corruption techniques.\nThe post-exploitation impact is constrained to the unauthorized retrieval or interaction with the specific system resource intended solely for authenticated users, preserving the segregation of standard user content."
}