Is CVE-2026-69226 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-69226?

CVE-2026-69226 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-69226

Description

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.