September 2026 ArcGIS Security Bulletin

By Mark Bierman and Randall Williams and Michael Young

The Portal for ArcGIS 2026 Security Update 4 patch has been released and is available here.

This patch resolves one critical and two medium severity security vulnerabilities in Portal for ArcGIS versions 12.1 and earlier.

This patch was released September 24th, 2026. We strongly encourage ArcGIS Enterprise customers apply this patch ASAP to minimize risk.

Patch Notes:

Cumulative – This patch is cumulative and does not require that you install any previous Portal for ArcGIS Security patches prior to installing this patch – Using the Patch Notification Utility can help ease this process. This patch is NOT dependent on other patches to be in place.
Esri has reserved CVE identifiers for the vulnerabilities fixed in this patch.
Mitigation – In order to mitigate these vulnerabilities, we strongly recommend all ArcGIS Enterprise customers install this patch as soon as possible.
- All issues are immediately remediated by installing this patch.
- Your Web Application Firewall (WAF) will help to block malicious patterns.
- Implementing the basic profile in the ArcGIS Hardening guide will reduce exposure.
- CVE-2026-69227 can be mitigated by temporarily removing any configured New Member default user type and role. If a New Member default user type and role is not defined, account creation restrictions cannot be bypassed. New Member default user types and roles may be re-enabled once this patch is installed. Remove New Member default user types and roles by editing the organization’s “self/userDefaultSettings” resource. See:
  - Configure new member defaults—ArcGIS Online Help | Documentation
  - /userDefaultSettings: User Default Settings | ArcGIS REST APIs | Esri Developer

Vulnerability Details

CVE-2026-69227 :

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (‘LDAP Injection’)
Base CVSSv3.1: 5.5 (medium)
Temporal CVSSv3.1: 5.3 (medium)
Affected: All Portal for ArcGIS versions 12.1 and prior