Portal for ArcGIS: Missing authentication for administrator API endpoints
Summary
Certain Portal Administrator API endpoints in Portal for ArcGIS can be accessed without authentication under specific conditions. An unauthenticated remote attacker could reach administrative functionality that should require login, with a CVSS score of 9.8. The conditions relate to the New Member default user type and role setting, and Esri does not describe the full trigger.
Affected
- Portal for ArcGIS 11.1 to 12.1 (per Esri; default configuration unaffected)
- Portal for ArcGIS 12.2: unknown, treat as potentially affected until Esri confirms
Fixed in
- Portal for ArcGIS 2026 Security Update 4 (released 24 September 2026 per Esri, cumulative)
- Build-level fixed version: unknown, check the Esri support page for your installation
Workaround
- Temporarily remove the configured New Member default user type and role (Esri: if no such type and role is defined, account creation restrictions cannot be bypassed)
- Apply the basic profile from the ArcGIS Hardening guide to reduce exposure
- Re-enable the setting only after the patch is installed
Exploitation
- No public exploit code has been confirmed in the sources checked
- Not recorded as actively exploited in the CISA KEV catalog (not independently verified)
- CISA SSVC: exploitation none, automatable yes, technical impact total
- No reports of exploitation in the wild found; absence of reports is not proof of absence
Our recommendation
- Inventory all Portal for ArcGIS installations and their exact versions, including 12.2
- Check whether any Portal is reachable from the internet and restrict access to internal networks
- Check the New Member default user type and role setting and remove it temporarily if patching cannot happen immediately
- Apply Portal for ArcGIS 2026 Security Update 4 and review the setting again afterwards
- Review Portal logs for unexpected administrator API activity
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Esri ArcGIS Security Bulletin September 2026 www.esri.com
- Esri Portal for ArcGIS Security 2026 Update 4 patch support.esri.com
- VulDB entry CVE-2026-69227 vuldb.com
- CVE-2026-69227 at The Hacker Wire www.thehackerwire.com
- CVE-2026-69227 at CVE Threat Intelligence cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:03.
Original description (NVD)
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.