CVE-2026-69227: BUG-000187331 Portal for ArcGIS has a security vulnerability
A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit the flaw when the affected Portal for ArcGIS instance meets the unspecified conditions required for access to certain /portaladmin/local API endpoints.
What level of access could an attacker obtain?
The flaw may allow access to administrative functionality that is intended to require authentication. The provided information does not identify which administrative functions or endpoints are accessible.
Are default Portal for ArcGIS deployments affected?
The issue is described as occurring only under specific conditions. The available information does not state whether those conditions exist in a default deployment.
How can I determine whether my environment is affected?
Review whether unauthenticated requests can access the relevant /portaladmin/local API endpoints. The provided information does not specify the exact conditions, affected versions, or a detection procedure.