CVE-2026-69227

{
  "etk_id": "ETK-2026-1483",
  "cve_id": "CVE-2026-69227",
  "display_id": "CVE-2026-69227",
  "ghsa_id": "GHSA-69m7-xwpq-gfc4",
  "euvd_id": "EUVD-2026-98842",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in Portal for ArcGIS administrator APIs",
  "summary": "Portal for ArcGIS can permit unauthenticated requests to certain Portal Administrator API endpoints under unspecified conditions. An unauthenticated attacker may gain access to administrative functions that are intended to require authentication.",
  "mitigation": "Apply the Portal for ArcGIS Security 2026 Update 4 Patch. Until patching is complete, restrict network access to Portal Administrator API endpoints to trusted administrators and networks.",
  "vendor": "Esri",
  "product": "Portal for ArcGIS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 12.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Portal for ArcGIS",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0033,
  "epss_percentile": 0.2425,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 23.574063966666667,
  "t0_at": "2026-10-13T16:03:43.423000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-13T18:14:13.411513+00:00",
      "days": 0.09062486704861111,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T16:03:43.423000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-13T16:03:43.423000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T16:03:43.423000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-69227"
    }
  }
}