{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aesriportal_for_arcgis/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-69227"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Portal for ArcGIS"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","web-application","arcgis"],"_cs_type":"advisory","_cs_vendors":["Esri"],"content_html":"\u003cp\u003eCVE-2026-69227 is a critical vulnerability (CVSS v3.1 score 9.8) affecting Esri Portal for ArcGIS. The flaw resides within the portal's administrative API, specifically targeting the /portaladmin/local endpoint. Under specific, documented configurations, the vulnerability allows unauthenticated attackers to bypass authentication controls and interact with functionality that is intended to be restricted to administrative users. This exposure allows a remote attacker to potentially manipulate portal settings, manage user accounts, or perform other unauthorized administrative actions without providing valid credentials. Given the core role of Portal for ArcGIS in managing geospatial data and services, this represents a significant security risk for organizations relying on the platform. Defenders should treat this as a high-priority update item, as the reach of the affected API covers critical administrative operations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized access to sensitive administrative functions within the ArcGIS environment. The potential damage includes the compromise of portal integrity, unauthorized changes to service configurations, and potential exfiltration or manipulation of geospatial data managed through the portal. While no specific victim counts are currently available, the prevalence of Portal for ArcGIS in enterprise and government geospatial infrastructure makes this a high-value target for threat actors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection engineering teams include monitoring for unauthorized access attempts to the management interface.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eReview web server and application logs for GET or POST requests directed at /portaladmin/local from unauthorized or external IP addresses.\u003c/li\u003e\n\u003cli\u003ePatch all instances of Portal for ArcGIS to the vendor-provided fixed version immediately upon release by Esri.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the /portaladmin/local endpoint at the edge firewall or web application firewall (WAF) to known administrative IP ranges until patching is complete.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:36:47Z","date_published":"2026-10-13T18:36:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-portal-arcgis-cve/","summary":"CVE-2026-69227 is a critical vulnerability in Portal for ArcGIS that allows unauthenticated access to administrative /portaladmin/local API endpoints, potentially permitting unauthorized administrative actions.","title":"Unauthenticated Administrative Access in Portal for ArcGIS","url":"https://feed.craftedsignal.io/briefs/2026-10-portal-arcgis-cve/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}