CVE-2026-69227

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Access to Portal for ArcGIS Admin Endpoints

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Environmental Systems Research Institute, Inc.

Description

A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-69227

EUVD

EUVD-2026-98842

Affected Vendors & Products

Vendor	Product	Version / Range
Esri	Portal	for ArcGIS 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in Portal for ArcGIS that allows unauthenticated access to certain administrative API endpoints under specific conditions. Normally these endpoints require authentication, but due to the flaw, an attacker could bypass this and access administrative functions.

Detection Guidance

To detect this vulnerability, scan for unauthenticated access to /portaladmin/local API endpoints in Portal for ArcGIS. Check web server logs for requests to these paths without prior authentication. Use tools like curl to test endpoints: curl -v http://<target>/portaladmin/local. Monitor for administrative functionality being exposed without credentials.

Impact Analysis

An attacker could exploit this to gain unauthorized access to administrative features, potentially leading to data breaches, unauthorized modifications, or disruption of services. The high CVSS score indicates severe impact.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR (data protection) and HIPAA (health information security). Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Apply the latest security patches or updates from Esri for Portal for ArcGIS to address the flaw in /portaladmin/local API endpoints. Ensure administrative endpoints are not exposed to unauthenticated access and review network configurations to restrict access to these endpoints.

Hi! I’m here to help you understand CVE-2026-69227. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70