External risk intelligence

Portal for ArcGIS Unauthenticated Access to Admin APIs

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-69227

Portal for ArcGIS is commonly deployed as an internet-facing service or enterprise gateway. The vulnerability affects administrative API endpoints which, while intended for administrators, are part of the core web-facing infrastructure of the product, making them potentially reachable if the portal is exposed to the internet.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Portal for ArcGIS, potentially allowing unauthorized access to administrative functions via specific API endpoints without requiring user authentication. This exposure could present a significant risk if an attacker were to exploit this flaw.

Unauthorized access to administrative features.
Potential for significant unauthorized administrative actions.
Confirm relevance and exposure for Portal for ArcGIS.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach and trigger this vulnerability by accessing specific administrative API endpoints within Portal for ArcGIS. If the portal is configured in a certain way, these endpoints might be exposed and accessible without requiring any user to log in. Successfully reaching these endpoints could allow an attacker to perform actions normally restricted to administrators.

No authentication required.
Accessing specific admin API endpoints.
Unauthorized administrative access.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated access to certain administrative API endpoints in Portal for ArcGIS could allow an attacker to perform actions typically reserved for administrators. This could occur when these specific endpoints are accessible, potentially impacting the integrity and availability of the portal and its services.

Administrative API endpoints.
Unauthenticated network access.
Unauthorized administrative actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Portal for ArcGIS, specifically affecting unauthenticated access to certain administrative API endpoints. The first practical move is to identify all instances of Portal for ArcGIS, determine their exposure (internet-facing or internal), and confirm their business criticality. Subsequently, the accountable owner for each instance should be identified to coordinate remediation based on the assessed risk.

Identify Portal for ArcGIS instances and owners.
Verify internet exposure and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Portal for ArcGIS?

Portal for ArcGIS is a core component of the ArcGIS Enterprise suite that allows organizations to share maps, scenes, and apps across their enterprise. It acts as a central hub for geographic data management, enabling users to collaborate securely. Many organizations host it as a web-accessible gateway to support remote access to spatial tools and administrative dashboards.

How does CVE-2026-69227 work?

This vulnerability is classified as CWE-306, which refers to a Missing Authentication for Critical Function. In this case, the software fails to verify the identity of a user before granting access to certain administrative API endpoints within the portal. Essentially, the system trusts requests to these sensitive functions without requiring a valid login, effectively bypassing the security controls that should protect administrative operations.

Do I need to be logged in to trigger this bug?

No. The flaw specifically allows unauthenticated access, meaning an attacker does not need an existing user account or valid credentials to interact with the affected API endpoints. It is important to note that this issue is limited to specific administrative endpoints; general user-facing portal features or unrelated services remain governed by standard authentication processes.

Is my Portal for ArcGIS at risk?

Your risk depends on how you have deployed the software. According to Halo Surface Signal, Portal for ArcGIS is frequently configured as an internet-facing service or enterprise gateway. If your specific instance is reachable from the public internet, these administrative API endpoints are more likely to be exposed to external actors. Instances restricted to internal-only networks face a lower profile of immediate external reachability.

What should I do first to address this?

Start by performing an inventory to locate every instance of Portal for ArcGIS currently running in your environment. Once identified, document which instances are accessible via the internet versus those strictly on internal networks. After assessing the exposure and business importance of each instance, coordinate with the respective system owners to establish a risk-based plan for applying updates or restricting network access.

References

www.esri.com/arcgis-blog/products/trust-arcgis/administration/sept…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.