Esri Portal for ArcGIS Security Update 4: Patching 3 CVEs (Critical Auth Bypass, LDAP Injection)

Vulnerability Overview Portal for ArcGIS 2026 Security Update 4 has been released, containing fixes for one critical and two medium-severity security vulnerabilities. Release Date: September 24, 2026. All ArcGIS Enterprise customers are strongly advised to apply this patch as soon as possible to minimize risk. Scope of Impact Portal for ArcGIS versions 12.1 and earlier. Remediation Install the patch: This is a cumulative patch; prior patches do not need to be installed separately. Use the Patch Notification Utility: To help simplify the patch installation process. Web Application Firewall (WAF): Can help block malicious patterns. ArcGIS Hardening Guidelines: Implement base profiles to reduce exposure. CVE-2026-69227: Mitigation involves temporarily removing the default user type and role configuration for New Members. Vulnerability Details CVE-2026-69227 CWE-306: Missing Authentication for Critical Function Base CVSSv3.1: 9.8 (Critical) Temporal CVSSv3.1: 9.4 (Critical) Affected: All Portal for ArcGIS versions 12.1 and earlier CVE-2026-69226 CWE-863: Improper Authorization Base CVSSv3.1: 6.5 (Medium) Temporal CVSSv3.1: 6.2 (Medium) Affected: All Portal for ArcGIS versions 12.1 and earlier CVE-2026-10759 CWE-90: Improper Neutralization of Special Elements in an LDAP Query (LDAP Injection) Base CVSSv3.1: 5.5 (Medium) Temporal CVSSv3.1: 5.3 (Medium) Affected: All Portal for ArcGIS versions 12.1 and earlier Additional Information Patch Notes: - Cumulative patch with no dependency on other patches. - Esri retains the CVE identifiers. - All ArcGIS Enterprise customers are strongly advised to install this patch as soon as possible. Mitigations: - All issues are immediately resolved by installing the patch. - Use a WAF to block malicious patterns. - Implement base profiles from the ArcGIS Hardening Guidelines. - For CVE-2026-69227, temporarily remove the default user type and role for New Members. Related Links Configure new member defaults—ArcGIS Online Help /userDefaultSettings: User Default Settings Summary Portal for ArcGIS 2026 Security Update 4 has been released, addressing three security vulnerabilities. All users are strongly advised to install the patch promptly to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Esri Portal for ArcGIS Security Update 4: Patching 3 CVEs (Critical Auth Bypass, LDAP Injection)