EUVD-2026-98842
GHSA-69m7-xwpq-gfc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing Portal for ArcGIS
-
DeliverySend unauthenticated request to /portaladmin/local endpoint
-
ExploitBypass authentication under vulnerable condition
-
ExecutionAccess administrative functionality
-
ImpactCompromise portal confidentiality/integrity/availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the /portaladmin/local API endpoints of Portal for ArcGIS and succeeds only 'under specific conditions' per the vendor description - the exact configuration, deployment mode, or portal state that enables the bypass is not detailed in the available data and must be confirmed via Esri's September 2026 ArcGIS security bulletin. The limiting factor is precisely these unspecified conditions: the flaw is not described as affecting all default installations, so a given portal may or may not be exposed depending on its configuration. The attacker needs network reachability to the portal's admin API and no credentials or user interaction (per PR:N/UI:N). |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as critical network-exploitable unauthenticated access with full CIA impact, consistent with CWE-306 (Missing Authentication for Critical Function). However, the description qualifies the flaw as occurring only 'under specific conditions,' which conflicts with the AC:L (low complexity) assigned in the input - a genuinely condition-dependent bypass more plausibly warrants AC:H. No EPSS score, CISA KEV listing, or POC indicator is present in the provided data, so there is no evidence of active exploitation or public exploit code at time of analysis; the 9.8 reflects theoretical worst-case impact rather than demonstrated in-the-wild use. This should be prioritized for patching as an unauthenticated admin-access bypass in an internet-facing enterprise portal, but the 'specific conditions' caveat means real-world exposure likely depends on deployment configuration and may be narrower than the raw score implies - verify applicable conditions against Esri's bulletin. |
| Exploit ScenarioDerived | An attacker who can reach a Portal for ArcGIS instance over the network sends crafted requests directly to /portaladmin/local API endpoints that, under certain deployment conditions, fail to enforce authentication, thereby reaching administrative functionality without valid credentials. No public exploit code is identified in the provided data. The CVSS AV:N/PR:N/UI:N profile indicates no credentials or user interaction are needed, though the description's 'specific conditions' suggest success is not universal across all installations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated access to administrative API endpoints in Esri Portal for ArcGIS can let remote attackers reach /portaladmin/local functionality that should require authentication, potentially exposing portal administration with high confidentiality, integrity, and availability impact. Exploitation is conditional - the independent assessment rates CVSS 3.1 as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning high impact but dependent on unspecified portal configuration conditions, while the vendor input vector is 9.8 with AC:L - and no public exploit has been identified at time of analysis. Affected product is Portal for ArcGIS, tracked by CPE cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*; consult Esri's September 2026 bulletin for exact affected versions and fixes.
RemediationAI
No exact vendor patch version is provided in the input data; apply the fix from Esri's September 2026 ArcGIS security bulletin (https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin) once available, and treat that bulletin as authoritative for affected and fixed versions. Until patched, restrict network access to the Portal for ArcGIS administrative interface, especially /portaladmin/local: block direct internet access to admin API paths, place the portal behind a reverse proxy or WAF that enforces authentication and allowlists trusted admin networks, and require VPN or zero-trust access for administration; these controls can break legitimate admin workflows and integrations if not scoped carefully. If /portaladmin/local endpoints are not required, disable or firewall them, but note this may disable local administrative or automation features. Enable and review audit logging for unauthenticated requests to /portaladmin/local and for unusual administrative actions, and monitor for exploitation attempts. Because no public exploit has been identified, these are precautionary but warranted given the unauthenticated admin-access potential and the vendor CVSS 9.8 score, while the independent assessment's AC:H rating indicates exploitability is tied to specific portal conditions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Portal for ArcGIS is Esri's web portal component within ArcGIS Enterprise, exposing administrative APIs under /portaladmin. The specific endpoints in scope are /portaladmin/local, which provide local administrative functions. The flaw is CWE-306 Missing Authentication for Critical Function: the application fails to enforce authentication on those endpoints under certain conditions. CPE cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:* identifies Portal for ArcGIS broadly rather than pinning a single release. The independent assessment assigns AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no privileges are needed (PR:N) and no user interaction is required (UI:N) if the enabling conditions are met, but attack complexity is High (AC:H) because the enabling portal state, configuration, or deployment mode is not documented in the available data. The exact condition that enables the bypass must be confirmed via Esri's September 2026 ArcGIS security bulletin.
Know when Portal For Arcgis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin API with no auth (AV:N/PR:N/UI:N), but 'specific conditions' required for the bypass warrants AC:H; unauthenticated admin access yields full C/I/A impact.
Primary rating from Vendor (Esri).
CVSS VectorVendor: Esri
DescriptionCVE.org
A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Executive ViewAI
A critical access-control flaw in Esri Portal for ArcGIS allows unauthenticated remote users to reach administrative portal functions that should require login, putting the confidentiality, integrity, and availability of the organization's GIS portal at risk. Because these portals frequently host sensitive basemaps, utility/asset layers, and location data - and are often internet-facing to support public and field users - a compromise could expose protected geospatial data, allow configuration or content tampering, or take mapping services offline for emergency response, operations, and public-facing services. No vendor patch or public exploit is currently available, but the potential for full administrative takeover warrants immediate leadership attention and interim containment.
No vendor-released patch identified at time of analysis. Interim mitigations: block or IP-restrict unauthenticated access to /portaladmin and /portaladmin/local at a reverse proxy, WAF, or network boundary; confirm anonymous access is disabled; isolate portal administration on a management network; rotate portal administrator credentials and tokens; and monitor logs for unauthorized administrative endpoint access pending the Esri September 2026 bulletin guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Portal For Arcgis
View allThere is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Rated critical severity (CVSS 9.9), this vulnerabi
Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a
Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 an
Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly
Privilege escalation in Esri Portal for ArcGIS 11.5 on Windows and Linux allows highly privileged users to mint develope
There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, una
There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 a
There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS version
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may all
There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that
Exploit-DB