Portal for ArcGIS Security 2026 Update 1 Patch

Esri announces the Portal for ArcGIS Security 2026 Update 1 Patch. Esri recommends that all customers using Portal for ArcGIS 12.0 , 11.5 and 11.4 apply this patch. This patch deals specifically with the issues listed below under Issues Addressed with this Patch. 

As a best practice, clear the browser cache and re-launch the browser after installing the patch.

This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and Uninstalling this patch on Linux sections below. A side-effect of this patch may cause administrative scripts that utilize API keys to stop functioning properly. This is a relatively rare situation, but if it happens, contact Esri Support for assistance in addressing any issues that arise with your administrative scripts.

Esri recommends developing a rollback plan before installing patches. This may be taking a snapshot of machines and related file servers or using the WebGIS DR tool as a software backup. See Back up and restore best practices for more information. For those utilizing a highly available environment, refer to the help topic on how to apply patches in a highly available environment for guidance.

Important Note – May 06, 2026: The 11.5 version of the Portal for ArcGIS Security 2026 Update 1 Patch has been updated to address BUG-000184442. Please install the new setup by downloading from this page or using the ArcGIS Enterprise Patch Notification Tool. It is not necessary to uninstall the original patch; the new setup will install and replace the original patch. The new patch, when shown as available in the ArcGIS Enterprise Patch Notification tool, is listed as Portal for ArcGIS Security 2026 Update 1 Patch with a release date of May 06, 2026; once installed, it is listed as Portal for ArcGIS Security 2026 Update 1 Patch C. The C version of this patch also includes additional bug fixes not related to security, refer to the updated Issues Addressed with this Patch section for the latest details.

Important Note – April 20, 2026: The 11.4 version of the Portal for ArcGIS Security 2026 Update 1 Patch is now available.

Important Note – April 16, 2026: The Portal for ArcGIS Security 2026 Update 1 Patch has been updated to address BUG-000184350. Please install the new setup by downloading from this page or using the ArcGIS Enterprise Patch Notification Tool. It is not necessary to uninstall the original patch; the new setup will install and replace the original patch. The new patch, when shown as available in the ArcGIS Enterprise Patch Notification tool, is listed as Portal for ArcGIS Security 2026 Update 1 Patch with a release date of April 20, 2026; once installed, it is listed as Portal for ArcGIS Security 2026 Update 1 Patch B.

BUG-000184350 - After installing the Portal for ArcGIS Security 2026 Update 1 Patch, access to the ArcGIS Enterprise portal deployment fails on systems configured with web-tier authentication.

For more information on the security vulnerabilities addressed, please see the ArcGIS Trust Center announcements.

• BUG-000184442 - 'Edit privileges' window of an application created by Developer Credentials is blank after installing Portal for ArcGIS 11.5 Security 2026 Update 1 Patch B. (11.5)
• BUG-000184350 - After installing the Portal for ArcGIS Security 2026 Update 1 Patch, access to the ArcGIS Enterprise portal deployment fails on systems configured with web-tier authentication. (12.0, 11.5)
• BUG-000184350 - After installing the Portal for ArcGIS Security 2026 Update 1 Patch, access to the ArcGIS Enterprise portal deployment fails on systems configured with web-tier authentication. (12.0, 11.5)
• BUG-000183038 - Portal for ArcGIS has a security vulnerability.  (12.0, 11.5, 11.4)
• BUG-000182353 - Portal for ArcGIS has a security vulnerability. (11.5 only) 
• BUG-000181192 - The item details page for the web map cannot be accessed when a classification scheme is enabled in ArcGIS Enterprise 11.5. (11.5)
• BUG-000173561 - The "Error: Create Service exception 'java.lang.Exception: Exception: Read timed out" error message is returned when publishing a hosted feature service via Portal for ArcGIS. (11.5)
• BUG-000175398 - When the password for a member in an ArcGIS Online or ArcGIS Enterprise account is changed, any API key previously created by the member stops working.(11.5)

To avoid conflicts the 12.0 version also addresses:

• BUG-000182430 - The metadata editor is missing translations for some strings.
• BUG-000181636 - The ArcGIS Experience Builder Business Analyst widget in ArcGIS Enterprise fails to load and returns the error message "This report can't be loaded" after upgrading to Google Chrome 142 or Microsoft Edge 143.
• BUG-000181346 - In ArcGIS Experience Builder, an Embed widget containing a Survey123 form from ArcGIS Enterprise fails to load and returns the error message "The survey is not accessible or does not exist." in Google Chrome 142 and Microsoft Edge 143.
• BUG-000180846 - In ArcGIS Dashboards, an embedded content element containing an ArcGIS Survey123 form from ArcGIS Enterprise fails to load with the error message "The survey is not accessible or does not exist" in Google Chrome 142 and Microsoft Edge 143.

To avoid conflicts the 11.5 version also addresses:

• BUG-000182125 - Selecting a classification from the item classification when saving a web map results in two classifications being selected.
• BUG-000181636 - The ArcGIS Experience Builder Business Analyst widget in ArcGIS Enterprise fails to load and returns the error message "This report can't be loaded" after upgrading to Google Chrome 142 or Microsoft Edge 143.
• BUG-000181403 - The survey form item details page 'Open in Survey123 app' option fails to launch the Survey123 app in disconnected environments.
• BUG-000181346 - In ArcGIS Experience Builder, an Embed widget containing a Survey123 form from ArcGIS Enterprise fails to load and returns the error message "The survey is not accessible or does not exist." in Google Chrome 142 and Microsoft Edge 143.
• BUG-000180912 - In ArcGIS Enterprise, the login page displays in English instead of the default language when 'Allow anonymous access to your portal' is disabled.
• BUG-000180846 - In ArcGIS Dashboards, an embedded content element containing an ArcGIS Survey123 form from ArcGIS Enterprise fails to load with the error message "The survey is not accessible or does not exist" in Google Chrome 142 and Microsoft Edge 143.
• BUG-000180830 - When publishing a hosted feature layer from a CSV or Excel file in ArcGIS Enterprise portal, the user-selected time zone is not honored.
• BUG-000180629 - When the Update Task is opened followed by opening the Create Task, status input is missing between the assignees input and the reports input.
• BUG-000180628 - After assigning a task without a report, the task is unable to be marked as Complete and provides the message "report required" even though the dropdown for the report in the task is set to None.
• BUG-000180627 - Updating a task, then sending a broadcast, followed by clicking on Create Task, opens the Update Task panel instead of opening the Create Task panel.
• BUG-000180091 - The 'Enable attachments' setting for reports is not retained in missions created from templates, resulting in missing attachment functionality in the new mission.
• BUG-000179864 - Creating a new mission report from the Mission Report template does not honor the saved field lengths in the template.
• BUG-000179860 - ArcGIS Survey123 forms are not added to a new ArcGIS Mission when using a mission template with surveys.
• BUG-000179857 - Mission report layers are not added to the map when a new mission is created from a mission template with reports.
• BUG-000179782 - When using the Statistics option in the Table widget of ArcGIS Experience Builder to query statistics for a field, the request fails if the underlying service is referenced from an SQL Server database.
• BUG-000179287 - "Failed to edit portal directory 'content'. JsonObject Code: 500" when editing the ArcGIS Enterprise content directory from the file system to the Amazon S3 bucket. 
• BUG-000179160 - ArcGIS Experience Builder is missing the option in the Print widget to 'Use layout from layout item' that is documented and was available previously.
• BUG-000179095 - In ArcGIS Mission Manager, last known location pins are disappearing from the map.
• BUG-000179037 - The Thai translation is incorrect for the Quote button when editing in ArcGIS StoryMaps in ArcGIS Enterprise. 
• BUG-000178714 - In ArcGIS Dashboards, the serial chart element data visually shifts when data queries update, such as map filtering or live data refresh.
• BUG-000178713 - Gauge widget value elements in ArcGIS Dashboards visually shift when data queries update, such as during map filtering or live data refreshes.
• BUG-000178512 - Selecting a classification from the picklist can result in two classifications being selected.
• BUG-000178457 - Administrators and those with the necessary administrative privileges cannot change the owner of data store items in the ArcGIS Enterprise portal.
• BUG-000178204 - The extentService set with 'URL to local map service' in a disconnected environment is ignored when using Metadata Editor and instead makes a request to an ArcGIS Online service.
• BUG-000177917 - Using 'Save As' in ArcGIS Knowledge Studio projects can corrupt unopened maps and link charts if the content item in the original project is deleted.
• BUG-000177915 - When multiple users edit the same project and one user deletes an unopened link chart, the project can become corrupted.
• BUG-000177808 - Web applications installed with Portal for ArcGIS 11.5 may intermittently fail to fully load all content, and the browser console returns the "ChunkLoadError: Loading chunk xxxx failed." error message.
• BUG-000177378 - In ArcGIS Experience Builder, non-administrative users cannot export map image layers published to ArcGIS Enterprise 11.5.
• BUG-000177330 - The home page editor does not display the View option, preventing the preview of the home page layout on desktop, tablet, and mobile devices.
• BUG-000177260 - Updating the federated server URL incorrectly updates portal content URLs, resulting in inaccessible content and negatively affecting federation.
• BUG-000176037 - ArcGIS Survey123 tokens time out after 30 minutes when the survey is embedded in ArcGIS Workflow Manager.
• BUG-000175748 - ArcGIS Mission Responder is not using enterprise basemaps.
• BUG-000175746 - ArcGIS Mission Manager tasks are positioned with the wrong location caused by the basemap.
• BUG-000175721 - Issues long queries for large datasets when searching for a feature from 'Recent search' or clearing the searches in the ArcGIS Experience Builder Search widget.
• BUG-000175706 - A pop-up configured with a feature service sometimes returns away from the searched-for point upon automatic zoom when using the Search widget in ArcGIS Web AppBuilder.
• BUG-000173253 - A map service with a different projection from the basemap results in an additional selection in ArcGIS Experience Builder.
• BUG-000162583 - Creating an offline map area fails when using a cached image service in the web map.

To avoid conflicts the 11.4 version also addresses:

• BUG-000181636 - The ArcGIS Experience Builder Business Analyst widget in ArcGIS Enterprise fails to load and returns the error message "This report can't be loaded" after upgrading to Google Chrome 142 or Microsoft Edge 143.
• BUG-000181346 - In ArcGIS Experience Builder, an Embed widget containing a Survey123 form from ArcGIS Enterprise fails to load and returns the error message "The survey is not accessible or does not exist." in Google Chrome 142 and Microsoft Edge 143.
• BUG-000180912 - In ArcGIS Enterprise, the login page displays in English instead of the default language when 'Allow anonymous access to your portal' is disabled.
• BUG-000180846 - In ArcGIS Dashboards, an embedded content element containing an ArcGIS Survey123 form from ArcGIS Enterprise fails to load with the error message "The survey is not accessible or does not exist" in Google Chrome 142 and Microsoft Edge 143.
• BUG-000180614 - 'Delete item' from the ArcGIS Enterprise Settings page keeps loading indefinitely.
• BUG-000179095 - In ArcGIS Mission Manager, last known location pins are disappearing from the map.
• BUG-000178089 - Portal for ArcGIS Security Patch 2 removes the builddate.txt and buildsources.txt from the installation framework.
• BUG-000177447 - Stored XSS vulnerability in Portal for ArcGIS.
• BUG-000176212 - Server-Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS.
• BUG-000176174 - Stored XSS vulnerability in Portal for ArcGIS.
• BUG-000176172 - Stored XSS vulnerability in Portal for ArcGIS.
• BUG-000176170 - Stored Cross Site scripting in Portal for ArcGIS.
• BUG-000176169 - Stored Cross Site scripting in Portal for ArcGIS.
• BUG-000175748 - ArcGIS Mission Responder is not using Enterprise basemaps.
• BUG-000175746 - ArcGIS Mission Manager tasks are positioned with the wrong location caused by the basemap.
• BUG-000175558 - Unable to create a new mission in ArcGIS Mission Manager after updating the portal default language, number, and date format.
• BUG-000175222 - Reflected XSS in Portal for ArcGIS.
• BUG-000174336 - Improper authentication issue in Portal for ArcGIS
• BUG-000174158 - Reflected XSS vulnerability in Portal for ArcGIS.
• BUG-000174155 - Stored XSS vulnerability in Portal for ArcGIS.
• BUG-000174153 - Stored XSS vulnerability in Portal for ArcGIS.
• BUG-000174150 - Unvalidated redirect in Portal for ArcGIS.
• BUG-000174149 - Unvalidated redirect in Portal for ArcGIS.
• BUG-000174022 - Reflected XSS vulnerability in Portal for ArcGIS.
• BUG-000173811 - Cannot add custom widgets from ArcGIS Web AppBuilder and ArcGIS Experience Builder to ArcGIS Enterprise.
• BUG-000170582 - The Survey123 step in ArcGIS Workflow Manager allows to continue with unsubmitted changes to the survey.
• BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS.

On Windows, the release date order of the patches does not matter when installing multiple patches. If an older patch is installed after a newer patch, the newer patch takes precedence and the fixes from the newer patch will remain. The ArcGIS Enterprise Patch Notification tool, when the option to install all available patches is activated, installs multiple patches in order of release date starting with oldest to newest.

The ArcGIS product listed in the table must be installed on your system before you can install a patch. Each patch setup is specific to the ArcGIS product in the list. To determine which products are installed on your system, please see the How to identify which ArcGIS products are installed section. Esri recommends that you install the patch for each product that is on your system.

Step 1: Download the appropriate file to a location other than your ArcGIS installation location.

ArcGIS Enterprise
Portal for ArcGIS 12.0	ArcGIS-120-PFA-SEC2026U1-PatchB.msp
Checksum      (SHA256)	DCF585B2BA1F96758F97C6E94083B3B84CAC221D73948236AED9532E470A629E
Portal for ArcGIS 11.5	ArcGIS-115-PFA-SEC2026U1-PatchC.msp
Checksum      (SHA256)	1D364128CF0C06009B4E8EA2A49543E83FBAAE24998E334CE7CC2B6D0770E0E4
Portal for ArcGIS 11.4	ArcGIS-114-PFA-SEC2026U1-Patch.msp
Checksum      (SHA256)	5FC3311A99F4E2C7694ECD7C2BB4E54C08DA6B28FEA273346EE567008D2A143C

Step 2: Make sure you have write access to your ArcGIS installation location.

Step 3: Double-click ArcGIS-<Version>-S-SEC2026U1-Patch.msp to start the setup process.

NOTE: If double clicking on the msp file does not start the setup installation, you can start the setup installation manually by using the following command:

Step 4: As a best practice, clear the browser cache and re-launch the browser after installing the patch.

On Linux, the release date order of the patches matters when installing multiple patches. If an older patch is installed after a newer patch, the older patch will replace the newer patch and the fixes in the newer patch will be removed. The ArcGIS Enterprise Patch Notification tool, when the option to install all available patches is activated, installs multiple patches in order of release date starting with oldest to newest.

Complete the following install steps as the ArcGIS Install owner. The Install owner is the owner of the arcgis folder.

The ArcGIS product listed in the table must be installed on your system before you can install a patch. Each patch setup is specific to the ArcGIS product in the list. To determine which products are installed on your system, please see the How to identify which ArcGIS products are installed section. Esri recommends that you install the patch for each product that is on your system.

Step 1: Download the appropriate file to a location other than your ArcGIS installation location.

/ArcGIS-115-PFA-SEC2026U1-PatchB-linux.tar">ArcGIS-115-PFA-SEC2026U1-PatchB-linux.tar

ArcGIS Enterprise
Portal for ArcGIS 12.0	ArcGIS-120-PFA-SEC2026U1-PatchB-linux.tar
Checksum      (SHA256)	604FA866770BC04C48484C92460FF57DA6FEB231F8719793F546A3E5B149BCAA
Portal for ArcGIS 11.5	ArcGIS-115-PFA-SEC2026U1-PatchC-linux.tar
Checksum      (SHA256)	45C0470A10D74D6E758EE155A1B017544F1862E1F119CE37F6583F7B1109815A
Portal for ArcGIS 11.4	ArcGIS-114-PFA-SEC2026U1-Patch-linux.tar
Checksum      (SHA256)	24D169E708DF91E5495A7C992FF8E684A069E2481B386A13FCD0F256EA97D25B

Step 2: Make sure have write access to your ArcGIS installation location, and that no one is using ArcGIS.

Step 3: Extract the specified tar file by typing:

Step 4: Start the installation by typing:

This will start the dialog for the menu-driven installation procedure. Default selections are noted in parentheses ( ). To quit the installation procedure, type 'q' at any time.

Step 5: As a best practice, clear the browser cache and re-launch the browser after installing the patch.

To uninstall this patch on Windows, open the Windows Control Panel and navigate to installed programs. Make sure that "View installed updates" (upper left side of the Programs and Features dialog) is active. Select the patch name from the programs list and click Uninstall to remove the patch.

Navigate to the <Product Installation Directory>/.Setup/qfe directory and run the following script as the ArcGIS Install owner:

The removepatch.sh script allows you to uninstall previously installed patches or hot fixes. Use the -s status flag to get the list of installed patches or hot fixes ordered by date. Use the -q flag to remove patches or hot fixes in reverse chronological order by date they were installed. Type removepatch -h for usage help.

Restart your ArcGIS services.

To determine which ArcGIS products are installed, choose the appropriate version of the PatchFinder utility for your environment and run it from your local machine. PatchFinder will list all products, hot fixes, and patches installed on your local machine.

PatchFinder for Windows

PatchFinder for Linux/Unix