← News
/DISPATCH · 2026-08-07

CVE-2026-13019: Esri Portal for ArcGIS Unprotected API Enables Unauthenticated Remote Takeover, CVSS 9.8, Patched

GIS vendor Esri patched a critical unauthenticated flaw in the account-recovery chain in the Portal for ArcGIS Security 2026 Update 2 Patch on June 23. CVE-2026-13019 scores CVSS 9.8: a remote unauthenticated attacker who hits an unprotected API can fully take over 12.1 and earlier. Covers Windows, Linux, and Kubernetes.

CVE-2026-13019 is a Critical issue Esri fixed in the Portal for ArcGIS Security 2026 Update 2 Patch on June 23, 2026. CVSS 3.1 score 9.8. In Portal for ArcGIS 12.1 and earlier, a remote account-recovery API lacks authentication. A remote unauthenticated attacker can hit that endpoint and fully break confidentiality, integrity, and availability. Esri also patched companion defect CVE-2026-13020 (weak password recovery, CVSS 8.1).

Overview

Portal for ArcGIS is Esri's enterprise GIS data management and sharing platform. Widely deployed in land administration, planning, public safety, water, power, and transportation. Root cause is CWE-306 Missing Authentication for Critical Function. The remote user account recovery ("Forgot password") workflow exposes an unauthenticated API endpoint. NVD vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No account. No user interaction. Network-reachable. High impact. MFA does not stop this. MFA only covers login. It does not block direct calls to the unprotected API for account takeover or data access. Esri's patch now requires SMTP enabled for remote password reset.

Technical details

Affected versions:

CVE-2026-13019 hits all three CIA elements. The component is outside the KEV candidate list, but EPSS is high. CISA-ADP injected SSVC metadata for this CVE and marked automatable as yes. Companion CVE-2026-13020 (weak password recovery) lets an attacker impersonate a user by manipulating question answers. That is CWE-640 Weak Password Recovery Mechanism for Forgotten Password, CVSS 8.1.

Esri's advisory states "actively responding to reports that an ArcGIS Enterprise account recovery configuration has been used in targeted attempts against customer environments". Targeted attempts against the account-recovery chain have been observed.

Impact

Portal for ArcGIS has high deployment density in critical infrastructure. Compromise of a single node can affect upstream systems (CORS services, feature services, geoprocessing tasks). No public in-the-wild exploit evidence yet. Esri's own advisory confirms "targeted attempts". CISA-ADP automatable: yes means the endpoint can be scanned and exploited at scale. PoC cost is low. Attack path is clear. Account and data value is high. Treat as urgent.

Mitigation

References