Critical Auth Bypass Flaw Found in Esri Portal for ArcGIS
Unauthenticated attackers can access admin APIs in Esri Portal for ArcGIS versions up to 12.2 via CVE-2026-69227.
Key points
- The flaw allows unauthenticated access to specific administrative endpoints.
- CVE-2026-69227 is rated critical with a CVSS score of 9.8.
- Esri Portal for ArcGIS versions up to 12.2 are affected.
A critical security vulnerability in Esri Portal for ArcGIS allows attackers to bypass authentication requirements. The flaw enables unauthenticated access to certain administrative API endpoints, potentially exposing sensitive functionality.
At a glance
- CVE
- CVE-2026-69227
- Product
- Esri Portal for ArcGIS
- CVSS
- 9.8 Critical
- Weakness
- missing authentication
- Exploited
- No known exploitation
The National Vulnerability Database lists the issue as CVE-2026-69227. It carries a CVSS score of 9.8, classifying it as critical severity. The weakness is categorized under CWE-306, relating to improper authentication mechanisms.
Technical Details and Scope
According to the NVD record, the flaw involves CWE-306. An attacker can exploit this by targeting specific /portaladmin/local API endpoints. These endpoints should require authentication but remain accessible under specific conditions without credentials.
This bypass allows unauthorized users to reach administrative functions. The description notes that these functions are meant to be protected. Exploiting this could enable an attacker to access administrative functionality that should require authentication.
Affected Versions
Esri Portal for ArcGIS versions up to 12.2 are affected by this vulnerability. Organizations running these versions should verify their current software status immediately. No higher versions are listed as affected in the available data.
The NVD record does not specify a release date for the flaw. It also does not indicate whether a patch is currently available. Users should monitor official channels for updates regarding remediation.
What should you do?
Administrators should audit access logs for unusual activity on administrative endpoints. Check for requests to /portaladmin/local that lack valid authentication tokens. Isolate affected systems if suspicious activity is detected to prevent further unauthorized access.
What to do and how to stay safe: Esri
- Review server logs for unauthenticated requests to administrative API paths.
- Restrict network access to the portal to trusted IP addresses only.
- Verify that your Esri Portal for ArcGIS version is not up to 12.2.
- Monitor for official vendor guidance on patches or workarounds.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-69227?
The CVSS score is 9.8, which is classified as critical severity.
Which Esri products are affected by this vulnerability?
Esri Portal for ArcGIS versions up to 12.2 are affected.
Is there a patch available for this flaw?
The source material does not confirm the existence of a patch or fix.
