topic Re: New secuity patch in April 2026 in ArcGIS Enterprise Portal Questions

New secuity patch in April 2026

JohnWatermolen_OCGIS — Fri, 17 Apr 2026 12:24:49 GMT

Is anyone having any issues with the new security patch that was just released for Portal? When I have tried to run it it hangs during the extract file task. The taskbar is about halfway. I have let it sit and run for about 10-15 minutes, and it doesn't move. Then, when I try to cancel it, it takes several attempts to cancel it. Sometimes it rolls back; other times, I have had to restart the server.

Any ideas or feedback would be helpful

Re: New secuity patch in April 2026

George_Thompson — Fri, 17 Apr 2026 12:43:48 GMT

Are you running it as an admin?

I just installed the updated patch and it took about 10 min total.

Re: New secuity patch in April 2026

Terry_Bearb — Tue, 21 Apr 2026 03:57:30 GMT

@JohnWatermolen_OCGIS did you ever get it to run successfully? I'm experiencing the same issue. I'm utilizing an admin account to run the patch and it has been running for over an hour now. I was stuck at the exact same stage you mentioned before I gave up and hit cancel.

Re: New secuity patch in April 2026

PhilippeVDV — Fri, 24 Apr 2026 12:34:38 GMT

@JohnWatermolen_OCGIS , yes I have the same observation on AWS EC2 instances. It took me one hour to get the patch installed. Just be patient, do not cancel it. In the end it will succeed.

Another customer of me runs on VMWare: there it took us only 10 minutes for the exact same patch.

I always disable the AV while installing patches, but on EC2 instances, even with AV disabled it goes very slow. No idea why

Re: New secuity patch in April 2026

LanceCole — Fri, 24 Apr 2026 18:13:48 GMT

We are applying the patch on Monday.

Did anyone notice a discrepancy between the number of OAuth 2.0 Developer Credentials listed in Organization > Settings > Security > Developer Credentials and the actual number of credentials you can find in use?

We have a count of nine (9) listed in Settings but can only find four (4) in use. Is there a means to generate a list of OAuth 2.0 Developer Credentials.

Re: New secuity patch in April 2026

LanceCole — Wed, 29 Apr 2026 13:41:04 GMT

Update:

The ArcGIS Server security patch installed in about 10 minutes on our GIS Servers. The Portal security patch took about 2 to 2-1/2 hours. Just let it set and it eventually it completed.

Our GIS Manager reached out to ESRI support and the unaccounted OAuth 2.0 Developer Credentials we noted are for "Esri_Apps" created by ESRI. Support was able to generate a json file listing all of the OAuth 2.0 Developer Credentials for our Enterprise deployment. However, I am awaiting details on how this was performed as I was not part of the call.

Support also noted this part of a known bug and referenced BUG-000184362. This must be fairly new as it is not listed yet on the ESRI Bug Report Site. Notes from ESRI below regarding the extra accounts noted.

Confirmed that this behavior is related to a known issue (BUG 000184362), which is currently closed and therefore cannot be attached to the case at this time. Once the bug is made publicly available, it can be referenced using its public URL.
• The issue is planned to be resolved in Portal for ArcGIS version 12.1.
• As confirmed by the Product Engineering team, this occurs because the query used by the Home app to count OAuth 2.0 credentials includes built in (default) credentials that are automatically created during installation.
• The query logic will be updated so that the OAuth 2.0 credentials owned by esri_apps are excluded from the count, ensuring consistency between the credentials shown under Settings and those visible under My Content.
• Confirmed that this behavior has no functional or security impact and does not require any action at this time.