Esri Portal for ArcGIS Hardcoded Credential Vulnerability Allowing Administrative Access

A hardcoded credential vulnerability has been identified in Esri Portal for ArcGIS versions 11.4 and prior. This vulnerability arises from a specific deployment pattern that may enable a remote authenticated attacker to gain administrative access to the system.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative access on the affected Portal for ArcGIS instance.

Remediation

Esri has released a security patch for this vulnerability as part of the Portal for ArcGIS Security 2025 Update 1 Patch. This patch should be applied immediately to all Portal for ArcGIS machines that are part of an ArcGIS Enterprise Site. The patch is available through the Esri Support website.