September 2026 ArcGIS Security Bulletin

The Portal for ArcGIS 2026 Security Update 4 patch has been released and is available here.

This patch resolves one critical and two medium severity security vulnerabilities in Portal for ArcGIS versions 12.1 and earlier.

This patch was released September 24th, 2026. We strongly encourage ArcGIS Enterprise customers apply this patch ASAP to minimize risk.

Patch Notes:

• Important Note – October 29, 2026: The Portal for ArcGIS Security 2026 Update 4 Patch has been updated to address BUG-000187930 – “Enterprise group membership is not resolved for users with an escaped comma in the distinguished name”.
• BUG-000187930 is not a security vulnerability. Plan to install this update as part of your normal patch cadence. 
• If you have already installed this patch, download and install the updated patch from this page or through the ArcGIS Enterprise Patch Notification Tool. There is no need to uninstall the original patch. The updated patch will automatically replace the previously installed version. In the ArcGIS Enterprise Patch Notification Tool, the updated patch continues to appear as Portal for ArcGIS Security 2026 Update 4 Patch but with a release date of September 24, 2026. After installation, it will be listed as Portal for ArcGIS Security 2026 Update 4 Patch B.
• Cumulative – This patch is cumulative and does not require that you install any previous Portal for ArcGIS Security patches prior to installing this patch – Using the Patch Notification Utility can help ease this process. This patch is NOT dependent on other patches to be in place.
• Esri has reserved CVE identifiers for the vulnerabilities fixed in this patch.
• Mitigation – In order to mitigate these vulnerabilities, we strongly recommend all ArcGIS Enterprise customers install this patch as soon as possible.
  • All issues are immediately remediated by installing this patch.
  • Your Web Application Firewall (WAF) will help to block malicious patterns.
  • Implementing the basic profile in the ArcGIS Hardening guide will reduce exposure.
  • CVE-2026-69227 can be mitigated by temporarily removing any configured New Member default user type and role. If a New Member default user type and role is not defined, account creation restrictions cannot be bypassed. New Member default user types and roles may be re-enabled once this patch is installed. Remove New Member default user types and roles by editing the organization’s “self/userDefaultSettings” resource. See:
    • Configure new member defaults—ArcGIS Online Help | Documentation
    • /userDefaultSettings: User Default Settings | ArcGIS REST APIs | Esri Developer

Vulnerability Details 

CVE-2026-69227 :

• CWE-306: Missing Authentication for Critical Function
• Base CVSSv3.1: 9.8 (critical)
• Temporal CVSSv3.1: 9.4 (critical)
• Affected: All Portal for ArcGIS versions 12.1 and prior

CVE-2026-69226:

• CWE-863 Incorrect Authorization
• Base CVSSv3.1: 6.5 (medium)
• Temporal CVSSv3.1: 6.2 (medium)
• Affected: All Portal for ArcGIS versions 12.1 and prior

CVE-2026-10759:

• CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (‘LDAP Injection’)
• Base CVSSv3.1: 5.5 (medium)
• Temporal CVSSv3.1: 5.3 (medium)
• Affected: All Portal for ArcGIS versions 12.1 and prior