CVE-2026-69228 is a missing authentication vulnerability (CWE-306) in Esri Portal for ArcGIS versions 12.0 and prior. It permits remote attackers without any privileges to access certain resources that should require authentication. The vulnerability affects specific ArcGIS Enterprise versions including 11.1, 11.3, 11.5, and 12.0. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild. No explicit patch links are provided, but users are encouraged to patch or upgrade to the latest long-term support release.

The vulnerability allows unauthorized remote access to a specific resource within Esri Portal for ArcGIS that should be restricted to authenticated users. This could lead to limited confidentiality loss but does not impact integrity or availability. User content is not affected. The moderate CVSS score reflects this limited impact.

Users running ArcGIS Enterprise versions 11.1, 11.3, 11.5, or 12.0 should apply available patches if provided by Esri or upgrade to the latest long-term support release to remediate this vulnerability. Patch status is not explicitly confirmed; therefore, users should consult the vendor advisory for current remediation guidance.