CVE-2025-57878

published 2025-09-29

CVE-2025-57878: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that…

Priority P4 32 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
esri	portal_for_arcgis	—	—
esri	portal_for_arcgis	—	—
esri	portal_for_arcgis	—	—
esri	portal_for_arcgis	—	—
esri	portal_for_arcgis	—	—
esri	portal_for_arcgis	—	—
esri	portal_for_arcgis	10.9.1 – 11.4	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-601