← News
/DISPATCH · 2026-08-07

CVE-2026-13019: Esri Portal for ArcGIS Unprotected API Enables Unauthenticated Remote Takeover, CVSS 9.8 Patched

Esri patched a critical unauthenticated flaw in the account-recovery chain in Portal for ArcGIS Security 2026 Update 2 Patch on 23 June. CVE-2026-13019 scores CVSS 9.8: a remote unauthenticated attacker who hits an unprotected API can fully take over 12.1 and earlier across Windows, Linux, and Kubernetes.

CVE-2026-13019 is a Critical vulnerability Esri fixed in the Portal for ArcGIS Security 2026 Update 2 Patch released 23 June 2026. CVSS 3.1 score 9.8: in Portal for ArcGIS 12.1 and earlier, a remote account-recovery API lacks authentication. A remote unauthenticated attacker can hit that endpoint and fully compromise confidentiality, integrity, and availability. Esri also patched companion defect CVE-2026-13020 (weak password recovery, CVSS 8.1).

Incident overview

Portal for ArcGIS is Esri's enterprise GIS data-management and sharing platform, widely deployed in land, planning, public safety, water, power, and transportation. Root cause is CWE-306 Missing Authentication for Critical Function: the remote user account-recovery ("Forgot password") workflow exposes an unauthenticated API endpoint. NVD vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — no account, zero interaction, network-reachable, high-severity impact. MFA does not help: it only covers login, not this unprotected API. Esri's patch now requires SMTP enabled for remote password reset.

Technical details

Affected versions:

CVE-2026-13019 hits all three CIA properties. The component is outside the KEV candidate list, but EPSS is high. CISA-ADP injected SSVC metadata and marked automatable as yes. Companion CVE-2026-13020 (weak password recovery) lets an attacker impersonate a user by manipulating question answers — CWE-640 Weak Password Recovery Mechanism for Forgotten Password, CVSS 8.1.

Esri's advisory states it is "actively responding to reports that an ArcGIS Enterprise account recovery configuration has been used in targeted attempts against customer environments".

Impact

Portal for ArcGIS density is high in critical infrastructure. A single-node compromise can affect upstream systems (CORS services, feature services, geoprocessing tasks). No public in-the-wild exploit evidence yet, but Esri confirmed "targeted attempts"; CISA-ADP automatable: yes means the endpoint can be scanned and mass-exploited. Low PoC cost, clear path, high account/data value — treat as urgent.

Remediation

Sources