Unauthorized Account Creation in Portal for ArcGIS by Esri
CVE-2026-69226

6.5MEDIUM

Key Information:

Vendor

Esri

Status
Portal For Arcgis
Vendor
CVE Published:
13 October 2026

What is CVE-2026-69226?

A security flaw in Portal for ArcGIS enables unauthorized users to create new user accounts through the sharing endpoint, even when self-service account registration is disabled. This vulnerability allows attackers to bypass the intended restrictions of the signup workflow by manipulating its processes, leading to potential unauthorized access and misuse of the system.

Affected Version(s)

Portal for ArcGIS Windows 0 <= 12.2

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/ad...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.