CVE-2026-69227
CriticalCVSS 9.8Summary
A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Risk Assessment
An unauthenticated attacker may gain access to portal administrative functionality, potentially leading to configuration changes, data disclosure, or portal takeover.
Recommendation
Apply available security updates for Portal for ArcGIS and restrict network access to the /portaladmin/local endpoints.
Other vulnerabilities in Portal for ArcGIS
See all- CVE-2026-69226Medium
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.
- CVE-2026-10759Medium
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.
Original NVD description (English source)
A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS