New secuity patch in April 2026

Question

Is anyone having any issues with the new security patch that was just released for Portal? When I have tried to run it it hangs during the extract file task. The taskbar is about halfway. I have let it sit and run for about 10-15 minutes, and it doesn't move. Then, when I try to cancel it, it takes several attempts to cancel it. Sometimes it rolls back; other times, I have had to restart the server.

Any ideas or feedback would be helpful

M_O · Answer

Hey all,

I had a similar experience. We are on AWS as well and it took around 30 mins or so often running at 100% CPU during the extraction on our DEV system. In the end it seems to work just fine.

LanceCole · Answer

Update:

The ArcGIS Server security patch installed in about 10 minutes on our GIS Servers.  The Portal security patch took about 2 to 2-1/2 hours.  Just let it set and it eventually it completed.

Our GIS Manager reached out to ESRI support and the unaccounted OAuth 2.0 Developer Credentials we noted are for "Esri_Apps" created by ESRI.  Support was able to generate a json file listing all of the OAuth 2.0 Developer Credentials for our Enterprise deployment.  However, I am awaiting details on how this was performed as I was not part of the call.

Support also noted this part of a known bug and referenced BUG-000184362.  This must be fairly new as it is not listed yet on the ESRI Bug Report Site.  Notes from ESRI below regarding the extra accounts noted.

Confirmed that this behavior is related to a known issue (BUG 000184362), which is currently closed and therefore cannot be attached to the case at this time. Once the bug is made publicly available, it can be referenced using its public URL.
• The issue is planned to be resolved in Portal for ArcGIS version 12.1.
• As confirmed by the Product Engineering team, this occurs because the query used by the Home app to count OAuth 2.0 credentials includes built in (default) credentials that are automatically created during installation.
• The query logic will be updated so that the OAuth 2.0 credentials owned by esri_apps are excluded from the count, ensuring consistency between the credentials shown under Settings and those visible under My Content.
• Confirmed that this behavior has no functional or security impact and does not require any action at this time.

LanceCole · Answer

We are applying the patch on Monday.

Did anyone notice a discrepancy between the number of OAuth 2.0 Developer Credentials listed in Organization >  Settings > Security > Developer Credentials and the actual number of credentials you can find in use?

We have a count of nine (9) listed in Settings but can only find four (4) in use.  Is there a means to generate a list of OAuth 2.0 Developer Credentials.