Esri Portal Users Face Critical Risk as CVE-2026-69227 Grants Unauthenticated Admin Access
A critical vulnerability in Esri’s mapping software permits attackers to bypass authentication and reach administrative API endpoints on affected versions.
Key points
- CVE-2026-69227 is rated critical with a CVSS score of 9.8
- The flaw affects Esri Portal for ArcGIS versions up to 12.2
- Attackers can access administrative functionality without credentials
A severe authentication bypass vulnerability in Esri Portal for ArcGIS allows attackers to access administrative functions without providing valid credentials. The flaw, tracked as CVE-2026-69227, carries a maximum severity rating of 9.8 on the Common Vulnerability Scoring System. It involves unauthenticated access to specific local API endpoints under certain conditions.
How it unfolded
- The vulnerability was recorded in the National Vulnerability Database with ID CVE-2026-69227
- Analysts identified that unauthenticated users could reach specific /portaladmin/local API endpoints
- The issue was classified under CWE-306 for incorrect default permissions
- Esri Portal for ArcGIS versions up to 12.2 were confirmed as affected by this flaw
Who is affected
Organisations using Esri Portal for ArcGIS versions up to 12.2 are exposed to this critical risk. The National Vulnerability Database records indicate that the flaw allows unauthenticated access to certain administrative endpoints under specific conditions. This means attackers could potentially access administrative functionality that should require authentication. The weakness is categorised as CWE-306, highlighting a failure in default permission settings that should restrict access to authorised personnel only.
The fix
No patch or update has been confirmed yet by the vendor to address CVE-2026-69227. Users of Esri Portal for ArcGIS versions up to 12.2 should assume their systems remain vulnerable until an official remediation is released. Administrators must monitor Esri’s security advisories closely for updates regarding this critical authentication bypass. Until a fix is available, limiting network exposure to the Portal for ArcGIS services is the primary mitigation strategy.
What analysts watch for
Security teams typically monitor for unauthorised access attempts to administrative endpoints, particularly those lacking valid authentication tokens. Analysts examine web server logs for requests to sensitive paths such as /portaladmin or similar administrative directories from unknown IP addresses. They also check for unusual spikes in API traffic that do not correlate with normal user activity. Persistent monitoring of access control lists helps detect configurations that may inadvertently permit open access to privileged functions.
What to do and how to stay safe: Esri
- Restrict network access to Esri Portal for ArcGIS services to trusted internal networks only
- Monitor web server logs for unauthenticated requests to administrative API endpoints
- Verify that default permissions have not been altered to allow open access
- Wait for the vendor to release an official update before applying any unverified patches
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-69227?
The vulnerability is rated critical with a CVSS score of 9.8.
Which versions of Esri Portal for ArcGIS are affected?
All versions of Esri Portal for ArcGIS up to 12.2 are affected by this flaw.
Is there a fix available for this authentication bypass?
No fix has been confirmed yet; users should wait for an official vendor update.
