CVE-2026-69227
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Risk Assessment
An attacker could access administrative portal functionality without logging in, potentially leading to unauthorized configuration changes and compromise of the GIS environment.
Recommendation
Apply security updates for Portal for ArcGIS and restrict network access to Portal Administrator API endpoints. Verify that administrative functionality is properly protected.
Other vulnerabilities in Portal for ArcGIS
See all- CVE-2026-69226Medium
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.
- CVE-2026-10759Medium
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.
Original NVD description (English source)
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS