CVE-2026-69228 Overview
CVE-2026-69228 is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior. A remote, unauthenticated attacker can access a specific resource that should only be accessible by authenticated users. The exposed resource does not contain user content, which limits the direct data impact. Esri advises customers running ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 to apply the patch. All customers should upgrade to the latest long-term support release. The weakness is classified under CWE-306: Missing Authentication for Critical Function.
Critical Impact
Unauthenticated network attackers can read a restricted resource in Esri Portal for ArcGIS, resulting in limited confidentiality exposure.
Affected Products
- Esri Portal for ArcGIS version 12.0 and prior
- ArcGIS Enterprise 11.1, 11.3, 11.5, and 12.0 deployments
- Non-long-term-support releases of ArcGIS Enterprise using Portal for ArcGIS
Discovery Timeline
- 2026-08-21 - CVE-2026-69228 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-69228
Vulnerability Analysis
The vulnerability exists in Esri Portal for ArcGIS, the web-facing component of ArcGIS Enterprise that manages user content, sharing, and administration. A specific server-side resource lacks an authentication check. Any remote client that reaches the Portal endpoint over the network can request the resource without credentials. The exposed data is not user content, but it should be restricted to authenticated users. The impact is confidentiality only. Integrity and availability are not affected based on the published CVSS vector.
Root Cause
The root cause is a missing authentication control on a specific Portal resource, mapped to CWE-306. The affected endpoint does not enforce identity verification before returning data. Applications that expose administrative or metadata resources commonly assume authentication is inherited from a parent handler. When that assumption fails, the resource becomes directly reachable. Esri fixed the flaw by adding the missing authentication requirement in the patched releases referenced in the August 2026 Esri ArcGIS Security Bulletin.
Attack Vector
Exploitation requires only network access to the Portal for ArcGIS web interface. No user interaction, privileges, or prior authentication are required. An attacker sends a crafted HTTP request to the vulnerable resource path and receives a response containing information intended for authenticated users. Internet-exposed Portal deployments face the highest risk. The vulnerability can be probed with standard HTTP clients such as curl or a browser.
No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been published at the time of this writing. See the Esri ArcGIS Security Bulletin for authoritative technical details.
Detection Methods for CVE-2026-69228
Indicators of Compromise
- Unauthenticated HTTP GET requests to Portal for ArcGIS endpoints returning 200 OK responses without a preceding authentication flow.
- Repeated requests from a single external IP address enumerating Portal REST paths under /arcgis/portaladmin/ or /arcgis/sharing/rest/.
- Access log entries showing successful responses on the affected resource with empty or missing session cookies and tokens.
Detection Strategies
- Review Portal for ArcGIS web server logs for successful anonymous responses on administrative or restricted resources.
- Correlate Portal access logs with authentication logs to identify sessions that consumed protected endpoints without a matching login event.
- Deploy a web application firewall rule that alerts on requests to the affected path lacking a valid token query parameter or Authorization header.
Monitoring Recommendations
- Forward Portal for ArcGIS access, security, and audit logs to a centralized SIEM for continuous review.
- Baseline normal request patterns to Portal endpoints and alert on volume anomalies from external sources.
- Track the installed Portal for ArcGIS build number across all ArcGIS Enterprise nodes to confirm patch status.
How to Mitigate CVE-2026-69228
Immediate Actions Required
- Apply the vendor patch referenced in the August 2026 Esri ArcGIS Security Bulletin to ArcGIS Enterprise 11.1, 11.3, 11.5, and 12.0.
- Inventory all Portal for ArcGIS instances, including internet-facing deployments, and prioritize externally exposed systems.
- Review historical Portal access logs for signs of prior unauthenticated access to restricted resources.
Patch Information
Esri released fixes covered in the August 2026 ArcGIS Security Bulletin. Administrators running ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 should install the corresponding Portal for ArcGIS security patch. Esri also recommends upgrading to the latest long-term support release for continued fixes. Consult the Esri ArcGIS Security Bulletin for the specific patch identifiers and installation instructions for your deployment version.
Workarounds
- Restrict network access to Portal for ArcGIS using firewall rules or a reverse proxy that limits traffic to trusted source ranges until the patch is applied.
- Place Portal behind an authenticating reverse proxy or web application firewall that requires valid credentials before requests reach the Portal service.
- Disable public internet exposure of Portal for ArcGIS administrative interfaces where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
