CVE-2026-69228

Executive Summary

CVE-2026-69228 is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior. A remote, unauthenticated attacker can access a specific resource that should only be accessible to authenticated users, leading to a low-severity confidentiality breach (CVSS 3.1 base score 5.3). The vulnerability affects organizations running ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 that have Portal for ArcGIS deployed. No public exploit code or proof-of-concept is currently available, and no patch has been released from any tracked source at the time of this report.

Technical Analysis

The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), indicating that the affected resource does not properly enforce an authentication requirement before granting access. The NVD description is sparse regarding implementation details; however, the vulnerability class itself is well-understood.

Vulnerability mechanism: The Portal for ArcGIS web application contains at least one resource endpoint or service handler that fails to verify whether the requesting user has been authenticated. In typical implementations of this flaw class, the application either:

• Skips a session-validation check for a specific route or API call.
• Trusts an HTTP request parameter or header that indicates authentication state without validating it against the session store.
• Misconfigures access control lists (ACLs) on a resource, leaving it world-readable.

Because the NVD description does not specify the exact URL path, parameter name, or function involved, we cannot confirm which of these mechanisms applies. We can infer that the resource is not user content (e.g., it is not a user-uploaded file or personal data store), but rather a system-level resource such as a configuration page, administrative metadata endpoint, or shared service catalog. The unauthenticated access yields a LOW confidentiality impact (C:L), suggesting the exposed data is limited in sensitivity — likely server configuration details, version information, or non-critical operational metadata.

Attack surface: The attack surface is the publicly exposed Portal for ArcGIS web application. Portal for ArcGIS is typically deployed on TCP port 7443 (default HTTPS) or 7080 (HTTP), though it can be bound to custom ports. The application is often accessible from the internet in organizations that provide GIS services to external stakeholders. The attack requires network access to the target (AV:N), no privileges (PR:N), and no user interaction (UI:N). The attack complexity is LOW (AC:L), meaning no special conditions are required to exploit the flaw.

Affected versions: Esri lists ArcGIS Enterprise 11.1, 11.3, 11.5, and 12.0 as affected. The phrase "versions 12.0 and prior" in the NVD description suggests the vulnerability exists across a broad version range, but the vendor advisory specifically names these four release lines. Portal for ArcGIS is the web portal component of ArcGIS Enterprise — a standalone installable component that organizations deploy alongside ArcGIS GIS Server, Data Store, and Web Adaptor.

Patch status: Patch confidence is 0/4 — no patch evidence from any tracked source. The vendor's guidance is to "upgrade to the latest long-term support release" but does not specify which release fixes this CVE. This is a notable discrepancy: the vendor encourages patching but no patch is publicly confirmed. Organizations should monitor Esri's support portal for the official fix.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-306) and is subject to change once the affected resource is disclosed by Esri.

Step 1 — Reconnaissance / Target identification: An attacker scans the internet for hosts responding on typical ArcGIS Portal ports (7080, 7443) or uses search engine dorks such as "Portal for ArcGIS" in the title or body. Shodan queries can identify the product banner or specific HTTP response headers. The attacker confirms the version by requesting the portal's version endpoint (commonly exposed on the login page footer or via a /portal/sharing/rest-style API, though we cannot confirm the exact endpoint from the description).

Step 2 — Triggering the flaw: The attacker sends a direct, unauthenticated HTTP request to the vulnerable resource. Because the flaw is missing authentication, the attack is a simple GET or POST request that does not carry a valid session cookie, API key, or token. The server processes the request as if the caller were authenticated. The attacker may need to guess or enumerate the resource path (e.g., via directory brute-forcing or by inspecting the JavaScript bundle served by the portal) — but no exploitation payload or complex manipulation is required.

Step 3 — Payload / execution method: At the vulnerability-class level, the "payload" is merely an unauthenticated HTTP request to the protected resource. There is no injection, buffer overflow, or deserialization involved. The attack succeeds by omission — the server fails to challenge the request. If the resource is an API endpoint, the attacker may append query parameters to refine what data is retrieved (e.g., requesting a specific record ID or configuration key), but this is speculative.

Step 4 — Post-exploitation impact: The attacker retrieves the exposed resource data. Given the CVSS confidentiality impact of LOW, the data is unlikely to contain credentials or PII. Likely candidates include: server build/version strings, feature flags, environment variables (non-secret), or a listing of non-sensitive portal items. This information can be used to fingerprint the exact installation and tailor subsequent attacks (e.g., targeting known CVEs for the specific ArcGIS Enterprise version). However, the attacker gains no direct foothold on the system, no code execution, and no ability to modify data (integrity impact: NONE; availability impact: NONE).

Impact Assessment

Business impact: The direct business impact is limited — a low-severity information disclosure. However, the security posture impact can be more significant. An attacker who successfully fingerprints the portal version can map it to known vulnerabilities, prioritizing follow-up exploitation attempts. In regulated environments (e.g., government, utilities, defense), even non-sensitive metadata disclosure may trigger compliance findings.

Affected systems: Any organization running Portal for ArcGIS as part of ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0. This includes on-premises deployments and private-cloud installations. The vulnerability does not affect ArcGIS Online (SaaS) nor ArcGIS Server when deployed without Portal.

Blast radius: The exposed resource is "not user content," which narrows the blast radius to system-level or shared resources rather than user-controlled data. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects: unauthenticated network access, no complexity, no privilege requirement, no user interaction, and a scope change indicator of U (unchanged) — meaning the compromise does not cross a trust boundary. The confidentiality loss is LOW, and there is zero integrity or availability impact.

CVSS rationale: The 5.3 base score is driven almost entirely by the network attack vector and lack of authentication requirement. The LOW confidentiality impact keeps the score below the 7.0 threshold that would be considered high severity. This is consistent with the description of a "specific resource" that is not user content.

Detection Guidance

The following detection rules target the behavior of an unauthenticated client requesting protected Portal for ArcGIS resources. Because the exact vulnerable path is undisclosed, these rules focus on broad anomaly detection: unauthenticated requests to portal API/resource paths that normally require a session token, and repeated 200 OK responses to such requests without an X-Esri-Auth or Authorization header (note: we cannot confirm header names from the NVD description — adjust based on your environment's traffic).

Sigma Rule

title: Unauthenticated Request to Esri Portal for ArcGIS Protected Resource
id: 5d3a9f6e-8c1b-4d2e-9f3a-7b8c9d0e1f2a
status: experimental
description: Detects HTTP requests to Esri Portal for ArcGIS that access known portal resource paths without authentication cookies or tokens, indicating possible CVE-2026-69228 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-69228
author: Valtersit Cyber Defense
date: 2026/05/15
logsource:
    category: webserver
    product: apache
    definition: 'Web server logs for Portal for ArcGIS (IIS or Tomcat)'
detection:
    selection_paths:
        cs-uri-stem|contains:
            - '/portal/sharing/rest'
            - '/portaladmin'
            - '/arcgis'
    selection_no_auth:
        cs-uri-query|contains: 'token='
        cs-uri-query|not|contains: 'token='
    condition: selection_paths and not selection_no_auth
    timeframe: 5m
level: medium
falsepositives:
    - Legacy internal scripts that use IP allowlisting instead of tokens
    - Health-check probes that hit portal endpoints

YARA Rule

rule CVE_2026_69228_Esri_Portal_ArcGIS_NoAuth_Access
{
    meta:
        author = "Valtersit Cyber Defense"
        description = "Detects HTTP request/response patterns indicative of unauthenticated access to Esri Portal for ArcGIS protected resources (CVE-2026-69228)"
        cve = "CVE-2026-69228"
        date = "2026-05-15"
        severity = "medium"

    strings:
        $portal_path = "/portal" ascii nocase
        $arcgis_rest = "sharing/rest" ascii nocase
        $admin_path = "portaladmin" ascii nocase
        $auth_header = "Authorization:" ascii nocase
        $token_param = "token=" ascii nocase
        $esri_cookie = "X-Esri-Auth" ascii nocase
        $http_200 = "HTTP/1.1 200" ascii

    condition:
        (($portal_path and $arcgis_rest) or $admin_path) and
        not ($auth_header or $token_param or $esri_cookie) and
        $http_200
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-69228 - Esri Portal for ArcGIS Unauthenticated Resource Access"; flow:to_server,established; content:"/portal/"; http_uri; content:"sharing/rest"; http_uri; nocase; content:"!Authorization:"; http_header; content:"!token="; http_uri; nocase; classtype:attempted-recon; sid:202669228; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE-2026-69228;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method == "GET" and
   (http.request.uri contains "/portal/sharing/rest" or
    http.request.uri contains "/portaladmin") and
   not http.request.headers.authorization != null and
   not http.request.uri contains "token="] with runs=5

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "(?i)/portal/(sharing/rest|portaladmin)") 
| search NOT (uri="*token=*" OR Authorization="*")
| stats count by src_ip, uri, status
| where count > 5
| eval severity="medium", cve="CVE-2026-69228"

Wazuh OSSEC Rule

<group name="esri_portal,">
  <rule id="692280" level="8">
    <decoded as="json">YES</decoded>
    <field name="url">\./portal/(sharing/rest|portaladmin)</field>
    <field name="http_headers.authorization">\.</field>  <!-- absent -->
    <field name="url" type="pcre2">(?i)(?!.*token=)</field>
    <description>Possible CVE-2026-69228: unauthenticated access attempt to Esri Portal for ArcGIS protected resource</description>
    <group>access_control,authentication_failures,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No vendor patch has been identified in any tracked source. The vendor has acknowledged the issue and recommends upgrading, but no specific fixed version has been published.

Immediate mitigations (until a patch is available):

1. Restrict network access: Use firewall rules or a Web Application Firewall (WAF) to restrict access to the Portal for ArcGIS web endpoints to only trusted IP ranges (e.g., corporate VPN users). If external access is not strictly required, remove the portal from public exposure entirely.
2. Enable IP-based access control in the Web Adaptor (if used) or in IIS/Tomcat to block requests from untrusted sources.
3. Review the specific resource: Since the vulnerable resource is unnamed in the NVD description, contact Esri Support for the internal resource identifier so you can add explicit authentication checks on the reverse proxy layer.
4. Monitor access logs: Enable verbose logging on the portal's web server and alert on unauthenticated requests returning HTTP 200 responses to portal paths.

Patch / upgrade steps:

1. Subscribe to Esri's security notification feed (https://trust.arcgis.com) to receive the fix announcement.
2. When a fixed version is released, apply the upgrade in a staging environment first.
3. Follow Esri's official upgrade documentation for Portal for ArcGIS — do not skip minor releases. Pay special attention to the long-term support release channel, which the vendor explicitly recommends.
4. Verify post-upgrade that the vulnerable resource now requires authentication by sending an unauthenticated request and confirming a 401/403 response.

Long-term hardening:

1. Deploy Portal for ArcGIS behind a reverse proxy (e.g., nginx, Apache) that enforces mandatory authentication at the proxy layer for all /portal paths, reducing reliance on the application's own auth checks.
2. Implement a WAF rule (ModSecurity/CRS) that blocks unauthenticated requests to the portal paths listed in the detection guidance, updating the rules once the specific vulnerable resource path is disclosed.
3. Conduct a quarterly review of external-facing web application inventory to identify and retire legacy ArcGIS Enterprise instances that are no longer supported.
4. Integrate ArcGIS Enterprise logs into a SIEM and build baseline traffic profiles so that anomaly detection can identify unusual unauthenticated access patterns.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69228 — Official NVD description and CVSS vector.
2. Esri Trust Center (vendor advisory): https://trust.arcgis.com — Esri's security disclosure page; check for the advisory linked to this CVE.
3. CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html — Weakness class reference.
4. Esri ArcGIS Enterprise Documentation: https://enterprise.arcgis.com/en/ — Official product documentation for upgrade paths and deployment guidance.
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — This CVE is NOT listed in the KEV catalog at the time of this report, indicating no confirmed exploit-in-the-wild activity.

Threat actor activity: No known exploitation campaigns or exploit-in-the-wild evidence has been reported for CVE-2026-69228. The absence of a public PoC and the LOW confidentiality impact suggest limited attacker interest; however, the vulnerability provides a useful reconnaissance primitive for targeted attacks against GIS infrastructure in the defense, utilities, and government sectors.