# Esri Portal-For-Arcgis vulnerabilities Source: https://junglewise.ai/threats/technologies/portal-for-arcgis Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/portal-for-arcgis.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 21 vulnerabilities in Esri Portal-For-Arcgis: 0 in the last 7 days and 17 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-50096, was published on 26 October 2026. 5 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 17 - All time: 21 (4 critical, 0 exploited in the wild) ## About Esri Portal-For-Arcgis Portal for ArcGIS is a web-based GIS platform for sharing maps, data, and spatial applications. ## Latest Esri Portal-For-Arcgis vulnerabilities - [CVE-2026-50096: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-50096-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri) (medium, CVSS 6.1, published 26 Oct 2026) - [CVE-2026-33520: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-33520-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri) (medium, CVSS 6.1, published 26 Oct 2026) - [CVE-2026-69227: Esri Portal for ArcGIS authentication bypass in admin API](https://junglewise.ai/threats/cve-2026-69227-a-flaw-in-portal-for-arcgis-allows-unauthenticated-access-to) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-69226: Esri Portal for ArcGIS account creation bypass in sharing endpoint](https://junglewise.ai/threats/cve-2026-69226-a-flaw-in-portal-for-arcgis-allows-unauthenticated-users-to) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-10759: Esri Portal for ArcGIS LDAP injection in administrative functionality](https://junglewise.ai/threats/cve-2026-10759-a-flaw-in-portal-for-arcgis-could-allow-ldap-injection-through) (medium, CVSS 5.5, published 13 Oct 2026) - [CVE-2026-69238: Esri Portal for ArcGIS HTML injection](https://junglewise.ai/threats/cve-2026-69238-esri-portal-for-arcgis-html-injection) (low, CVSS 3.5, published 21 Aug 2026) - [CVE-2026-69237: Esri Portal for ArcGIS HTML injection in administrative API](https://junglewise.ai/threats/cve-2026-69237-esri-portal-for-arcgis-html-injection-in-administrative-api) (low, CVSS 3.8, published 21 Aug 2026) - [CVE-2026-69235: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69235-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 6.1, published 21 Aug 2026) - [CVE-2026-69234: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-69234-esri-portal-for-arcgis-reflected-cross-site-scripting) (medium, CVSS 6.1, published 21 Aug 2026) - [CVE-2026-69233: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69233-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 5.5, published 21 Aug 2026) - [CVE-2026-69232: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69232-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 5.5, published 21 Aug 2026) - [CVE-2026-69231: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69231-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 5.5, published 21 Aug 2026) - [CVE-2026-69230: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69230-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 5.5, published 21 Aug 2026) - [CVE-2026-69229: Esri Portal for ArcGIS HTML injection](https://junglewise.ai/threats/cve-2026-69229-esri-portal-for-arcgis-html-injection) (medium, CVSS 5.4, published 21 Aug 2026) - [CVE-2026-69228: Esri Portal for ArcGIS authentication bypass in resource access](https://junglewise.ai/threats/cve-2026-69228-esri-portal-for-arcgis-authentication-bypass-in-resource-access) (medium, CVSS 5.3, published 21 Aug 2026) - [CVE-2026-69225: Esri Portal for ArcGIS information disclosure via HTTP response reflection](https://junglewise.ai/threats/cve-2026-69225-esri-portal-for-arcgis-information-disclosure-via-http-response) (medium, CVSS 5.9, published 21 Aug 2026) - [CVE-2026-69224: Esri Portal for ArcGIS information disclosure in HTTP response](https://junglewise.ai/threats/cve-2026-69224-esri-portal-for-arcgis-information-disclosure-in-http-response) (medium, CVSS 5.9, published 21 Aug 2026) - [CVE-2026-13020: Esri Portal for ArcGIS weak password recovery mechanism](https://junglewise.ai/threats/cve-2026-13020-esri-portal-for-arcgis-weak-password-recovery-mechanism) (high, CVSS 8.1, published 7 Jul 2026) - [CVE-2026-13019: Esri Portal for ArcGIS missing authentication for critical function](https://junglewise.ai/threats/cve-2026-13019-esri-portal-for-arcgis-missing-authentication-for-critical) (critical, CVSS 9.8, published 7 Jul 2026) - [CVE-2026-33519: Esri Portal for ArcGIS incorrect authorization in developer credentials](https://junglewise.ai/threats/cve-2026-33519-esri-portal-for-arcgis-incorrect-authorization-in-developer) (critical, CVSS 9.8, published 21 Apr 2026) - [CVE-2026-33518: Esri Portal for ArcGIS incorrect privilege assignment](https://junglewise.ai/threats/cve-2026-33518-esri-portal-for-arcgis-incorrect-privilege-assignment) (critical, CVSS 9.8, published 21 Apr 2026) ## Most severe Esri Portal-For-Arcgis vulnerabilities - [CVE-2026-69227: Esri Portal for ArcGIS authentication bypass in admin API](https://junglewise.ai/threats/cve-2026-69227-a-flaw-in-portal-for-arcgis-allows-unauthenticated-access-to) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-33519: Esri Portal for ArcGIS incorrect authorization in developer credentials](https://junglewise.ai/threats/cve-2026-33519-esri-portal-for-arcgis-incorrect-authorization-in-developer) (critical, CVSS 9.8, published 21 Apr 2026) - [CVE-2026-33518: Esri Portal for ArcGIS incorrect privilege assignment](https://junglewise.ai/threats/cve-2026-33518-esri-portal-for-arcgis-incorrect-privilege-assignment) (critical, CVSS 9.8, published 21 Apr 2026) - [CVE-2026-13019: Esri Portal for ArcGIS missing authentication for critical function](https://junglewise.ai/threats/cve-2026-13019-esri-portal-for-arcgis-missing-authentication-for-critical) (critical, CVSS 9.8, published 7 Jul 2026) - [CVE-2026-13020: Esri Portal for ArcGIS weak password recovery mechanism](https://junglewise.ai/threats/cve-2026-13020-esri-portal-for-arcgis-weak-password-recovery-mechanism) (high, CVSS 8.1, published 7 Jul 2026) - [CVE-2026-69226: Esri Portal for ArcGIS account creation bypass in sharing endpoint](https://junglewise.ai/threats/cve-2026-69226-a-flaw-in-portal-for-arcgis-allows-unauthenticated-users-to) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-69234: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-69234-esri-portal-for-arcgis-reflected-cross-site-scripting) (medium, CVSS 6.1, published 21 Aug 2026) - [CVE-2026-69235: Esri Portal for ArcGIS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-69235-esri-portal-for-arcgis-stored-cross-site-scripting) (medium, CVSS 6.1, published 21 Aug 2026) - [CVE-2026-50096: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-50096-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri) (medium, CVSS 6.1, published 26 Oct 2026) - [CVE-2026-33520: Esri Portal for ArcGIS reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-33520-there-is-a-reflected-cross-site-scripting-vulnerability-in-esri) (medium, CVSS 6.1, published 26 Oct 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 12 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Esri technologies - [Esri ArcGIS Server](https://junglewise.ai/threats/technologies/arcgis-server): 18 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Esri Portal-For-Arcgis vulnerabilities", https://junglewise.ai/threats/technologies/portal-for-arcgis, 13 November 2026.