---
id: CVE-2026-69227
title: |-
  A flaw in Portal for ArcGIS allows unauthenticated access to 

  certain Portal Administrator API endpoints under specific conditions
summary: >-
  A flaw in Portal for ArcGIS allows unauthenticated access to 


  certain Portal Administrator API endpoints under specific conditions. This
  could enable an attacker to access administrative functionality that should
  require authentication.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: Esri
product: Portal for ArcGIS
affected:
  - portal_for_arcgis >= 11.1 <= 12.1
published: '2026-10-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:39:43.620'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69227'
references:
  - url: >-
      https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin
    label: psirt@esri.com
tags:
  - nvd
  - cve.org
epss: 0.00326
epssPercentile: 0.25567
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-13T00:00:00+00:00'
ingestedAt: '2026-10-13T17:38:53.198Z'
---

## Overview

A flaw in Portal for ArcGIS allows unauthenticated access to 

certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.