Portal for ArcGIS EUVD-2026-98845

Exploitation requires that the target run Portal for ArcGIS with self-service account registration disabled (disableSignup=true) - this is the specific configuration the flaw bypasses, and it is the deployment mode security-conscious orgs choose, making them the primary targets. The attacker must be able to reach the portal's sharing endpoint over the network; no authentication (PR:N) and no user interaction (UI:N) are needed. The practical limit on impact is scope: the value of a created account depends on what content and roles the portal grants to a default new member, so instances that expose little to ordinary members gain less for the attacker. Internet-exposed portals are at highest realistic risk; instances reachable only on segmented internal networks are correspondingly constrained.

This is a moderate-severity authorization flaw (CWE-863), not a top-tier emergency. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5) indicates a remotely reachable, low-complexity, unauthenticated issue, which raises concern - but the impact is capped at Low/Low with no availability impact, reflecting that the outcome is unauthorized account creation rather than direct code execution or data destruction. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data; based on signals available, there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (an unauthenticated network bypass of a sign-up restriction logically matches PR:N/AV:N/AC:L), but the real-world severity hinges on what a freshly created account can reach in a given deployment - in orgs that expose sensitive content to any registered member, the effective impact exceeds the raw 6.5. Treat this as a prioritized-but-not-critical patch item for internet-facing Portal for ArcGIS instances, especially those that deliberately set disableSignup=true for security reasons.

An organization running Portal for ArcGIS has disabled self-service registration (disableSignup=true) to keep its portal invite-only, yet an unauthenticated attacker reaches the sharing endpoint over the network and manipulates the signup workflow to register a new account anyway. The attacker gains an authenticated foothold that can then be used to access org-shared content or stage further abuse. No public exploit was identified at time of analysis, and no user interaction is required.