Esri Portal for ArcGIS Unvalidated Redirect Vulnerability Allowing Phishing Attacks

A vulnerability allowing unvalidated redirects has been identified in Esri Portal for ArcGIS versions 11.4 and prior. This issue may enable a remote, unauthenticated attacker to create a URL that redirects a victim to an arbitrary website, potentially facilitating phishing attacks.

Impact

Exploitation of this vulnerability could lead to successful phishing attempts, as victims could be redirected to malicious websites.

Remediation

Esri has released a security patch for this vulnerability as part of the Portal for ArcGIS Security 2025 Update 3 Patch. This patch is cumulative and includes all fixes from previous updates. Instructions for applying the patch are available on the Esri Support website.