Vulnerability in Esri Portal for ArcGIS

[ Description ]Official description

A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund27 Sep 2026WID-SEC-2026-3601

  ESRI ArcGIS: Multiple vulnerabilities allow an unspecified attack Translated from German

  CVE-2026-10759CVE-2026-69226CVE-2026-69227

[ References ]References

• www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-sec…