Description
A flaw in Portal for ArcGIS allows unauthenticated access to

certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Published: 2026-10-13
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Administrative Access
Action: Apply Patch
AI Analysis

Impact

A flaw in Portal for ArcGIS permits unauthenticated access to specific Portal Administrator API endpoints when certain conditions are met. This allows an attacker to perform administrative actions that normally require authentication, such as modifying configuration or accessing sensitive data. The vulnerability is an authentication bypass, which aligns with CWE-306.

Affected Systems

Esri's Portal for ArcGIS. No specific version information is supplied, so all deployed instances of Portal for ArcGIS are potentially affected unless a later patch has been applied.

Risk and Exploitability

The CVSS score of 9.8 highlights critical severity, while the EPSS score of 0.326% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network-based access to the /portaladmin/local endpoints and requires no authentication, giving attackers administrative capabilities that could lead to extensive system compromise.

Generated by OpenCVE AI on October 17, 2026 at 06:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest security patch released by Esri for Portal for ArcGIS; all instances should be updated promptly.
  • Restrict network access to the /portaladmin/local API endpoints by configuring firewalls or network segmentation so that only trusted administrative hosts can reach them, thereby reducing the attack surface.
  • Enforce authentication for all administrative API endpoints, ensuring that no unauthenticated requests can reach critical functions. If the current configuration allows it, reconfigure to require credentials.
  • Monitor logs for unusual attempts to access administrative endpoints and set up alerts to detect potential exploitation attempts.

Generated by OpenCVE AI on October 17, 2026 at 06:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication. A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

Tue, 13 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Esri
Esri portal For Arcgis
Vendors & Products Esri
Esri portal For Arcgis

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Title BUG-000187331 Portal for ArcGIS has a security vulnerability
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Esri Portal For Arcgis
cve-icon MITRE

Status: PUBLISHED

Assigner: Esri

Published:

Updated: 2026-10-14T18:34:28.680Z

Reserved: 2026-08-03T19:22:01.731Z

Link: CVE-2026-69227

cve-icon Vulnrichment

Updated: 2026-10-13T19:21:46.703Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T17:17:45.130

Modified: 2026-10-16T15:39:43.620

Link: CVE-2026-69227

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T07:00:04Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function