{"id":"CVE-2026-69227","published":"2026-10-13T17:17:45.130","lastModified":"2026-10-16T15:39:43.620","description":"A flaw in Portal for ArcGIS allows unauthenticated access to \n\ncertain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical authentication bypass flaw in Portal for ArcGIS allows unauthenticated attackers to access administrative API endpoints that should normally require authentication. This creates a high-risk vector for unauthorized access to sensitive administrative functions.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability affects unauthenticated access to /portaladmin/local API endpoints, requiring only network access to the affected system.","blast_radius":"If exploited, attackers could gain full administrative control over Portal for ArcGIS installations, potentially compromising all geospatial data, user accounts, and system configurations.","remediation":"Disable the affected /portaladmin/local API endpoints until a patch is available, or restrict access to these endpoints via network segmentation and authentication requirements.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","gis","api"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:47:02.539Z"}}