{"schema_version":"1","data":[{"id":22999,"advisory_id":"99b45d5c-9db4-47d9-b7c5-a29486524a84","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-69227","source_published_at":"2026-10-13T16:03:43.423+00:00","published_at":"2026-10-25T06:11:01.422447+00:00","extraction_method":"structured","technologies":["core-cve","portal-for-arcgis"],"cve_ids":["CVE-2026-69227"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"BUG-000187331 Portal for ArcGIS has a security vulnerability","summary":"A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.","evidence":"cve:CVE-2026-69227","products":[{"name":{"value":"Portal for ArcGIS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-69227","aliases":["CVE-2026-69227"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Esri","product":"Portal for ArcGIS","versions":[{"status":"affected","version":"11.1","versionType":"custom","lessThanOrEqual":"12.1"}],"platforms":["Windows","Linux"],"defaultStatus":"unaffected"}],"modified":"2026-10-14T18:34:28.680Z","provider":"cve","references":["https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-69227","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T03:59:16.301Z"}}],"cna":{"orgId":"cedc17bb-4939-4f40-a1f4-30ae8af1094e","shortName":"Esri","dateUpdated":"2026-10-14T18:34:28.680Z"}}},"related_cves":[{"value":"CVE-2026-69227","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":20719,"advisory_id":"9157062b-b538-4fa2-834d-c24aeb3c4c7f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-69226","source_published_at":"2026-10-13T16:06:23.982+00:00","published_at":"2026-10-25T05:33:26.841195+00:00","extraction_method":"structured","technologies":["core-cve","portal-for-arcgis"],"cve_ids":["CVE-2026-69226"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Portal for ArcGIS has a security vulnerability","summary":"A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.","evidence":"cve:CVE-2026-69226","products":[{"name":{"value":"Portal for ArcGIS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-69226","aliases":["CVE-2026-69226"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Esri","product":"Portal for ArcGIS","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.2"}],"platforms":["Windows","Linux"],"defaultStatus":"unaffected"}],"modified":"2026-10-13T19:31:31.076Z","provider":"cve","references":["https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-69226","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T17:05:39.370455Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T19:31:31.076Z"}}],"cna":{"orgId":"cedc17bb-4939-4f40-a1f4-30ae8af1094e","shortName":"Esri","dateUpdated":"2026-10-13T16:06:23.982Z"}}},"related_cves":[{"value":"CVE-2026-69226","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":20710,"advisory_id":"9b8f5c02-3b4a-4c51-880b-d991f48b51a9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-10759","source_published_at":"2026-10-13T16:04:54.961+00:00","published_at":"2026-10-25T05:33:21.328283+00:00","extraction_method":"structured","technologies":["core-cve","portal-for-arcgis"],"cve_ids":["CVE-2026-10759"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"BUG-000171040 Portal for ArcGIS has a security vulnerability","summary":"A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.","evidence":"cve:CVE-2026-10759","products":[{"name":{"value":"Portal for ArcGIS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-10759","aliases":["CVE-2026-10759"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Esri","product":"Portal for ArcGIS","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"12.2"}],"platforms":["Windows","Linux"],"defaultStatus":"unaffected"}],"modified":"2026-10-13T19:31:31.225Z","provider":"cve","references":["https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-10759","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T17:06:00.530560Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T19:31:31.225Z"}}],"cna":{"orgId":"cedc17bb-4939-4f40-a1f4-30ae8af1094e","shortName":"Esri","dateUpdated":"2026-10-13T16:04:54.961Z"}}},"related_cves":[{"value":"CVE-2026-10759","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3961,"advisory_id":"b26fa593-c692-49e9-be8c-a46e4bb4f8c2","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-13019","source_published_at":"2026-07-07T16:40:53.066+00:00","published_at":"2026-10-24T21:44:21.787966+00:00","extraction_method":"structured","technologies":["core-cve","portal-for-arcgis"],"cve_ids":["CVE-2026-13019"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Missing Authentication","summary":"Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability.","evidence":"cve:CVE-2026-13019","products":[{"name":{"value":"Portal for ArcGIS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-13019","aliases":["CVE-2026-13019"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Esri","product":"Portal for ArcGIS","versions":[{"status":"affected","version":"0","lessThan":"12.1","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-09-29T19:31:13.668Z","provider":"cve","references":["https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/june-2026-arcgis-security-bulletin"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-13019","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-07-07T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-08T03:56:44.996Z"}}],"cna":{"orgId":"cedc17bb-4939-4f40-a1f4-30ae8af1094e","shortName":"Esri","dateUpdated":"2026-09-29T19:31:13.668Z"}}},"related_cves":[{"value":"CVE-2026-13019","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":22999,"next_before":3961}