Unauthenticated API Access Flaw in Esri Portal for ArcGIS Rated Critical

A critical authentication bypass vulnerability has been identified in Esri Portal for ArcGIS. The flaw permits unauthenticated users to access sensitive administrative API endpoints under specific conditions.

What happened

The National Vulnerability Database record for CVE-2026-69227 describes a flaw within Esri Portal for ArcGIS. This issue affects all versions of the software up to and including version 12.2. The vulnerability is classified under CWE-306, which relates to authentication issues.

According to the NVD, the flaw allows an attacker to access certain API endpoints without providing credentials. These endpoints are located under the /portaladmin/local path. Access to these endpoints should normally require successful authentication by a user.

The NVD assigns a CVSS score of 9.8 to this vulnerability. This score places the issue in the Critical severity range. The rating reflects the severity assessment provided by the database for this specific flaw.

Why it matters

For security operations teams, this vulnerability presents a significant risk to environments running Esri Portal for ArcGIS. The ability to access administrative functionality without authentication can lead to unauthorized changes or data exposure.

The specific nature of the flaw, targeting API endpoints, means that traditional perimeter defenses may not detect the initial access attempt. Attackers can leverage this bypass to perform actions that require elevated privileges. This could compromise the integrity of the entire portal environment.

Environments running versions up to 12.2 are exposed to this risk. Teams must verify their current version and assess whether the affected endpoints are accessible from untrusted networks. The lack of authentication requirements for these specific endpoints is the core of the risk.

Our take on the response

• Verify the version of Esri Portal for ArcGIS currently in use
• Check if /portaladmin/local endpoints are accessible from external networks
• Monitor logs for unauthenticated requests to administrative API paths
• Restrict network access to the portal to trusted IP addresses where possible

What defenders should look for

Teams usually detect this type of activity by monitoring for anomalous traffic to administrative endpoints. Look for successful API calls to /portaladmin/local paths that lack associated authentication tokens or session cookies. Check for unusual configuration changes or user creation events that occur without prior login activity. Review web server access logs for requests originating from unknown IP addresses targeting sensitive API routes. If such activity is observed, isolate the affected system immediately to prevent further unauthorized access.

Background: Unauthorized access

Most teams assume unauthorized access means broken encryption or stolen passwords. In reality, attackers often use valid accounts, legitimate tools, and internal trust relationships. Detection fails because alerts are tuned to look for outsiders, not insiders acting strangely.

Read the full guide: Unauthorized Access Myths: What Detection Actually Misses

What to do and how to stay safe: Esri

• Audit your Esri Portal for ArcGIS installation to confirm the version number
• Review firewall rules to ensure administrative endpoints are not exposed to the internet
• Monitor access logs for unauthenticated requests to /portaladmin/local paths
• Prepare to apply updates once the vendor provides a confirmed fix

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-69227?

It is a critical vulnerability in Esri Portal for ArcGIS that allows unauthenticated access to certain administrative API endpoints.

Which versions of Esri Portal for ArcGIS are affected?

All versions up to and including 12.2 are affected by this vulnerability.

What is the CVSS score for this flaw?

The National Vulnerability Database rates CVE-2026-69227 with a CVSS score of 9.8, which is considered Critical.