CVE-2026-10759— BUG-000171040 Portal for ArcGIS has a security vulnerability
Quick assessment
Affected
Esri Portal for ArcGIS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ArcGIS Portal 中存在一个安全漏洞，该漏洞允许通过其管理功能进行 LDAP 注入。这些功能在构建 Active Directory 或 LDAP 搜索查询时，未能对输入进行充分的中庸化处理（即缺乏足够的输入过滤或净化）。经身份验证的管理员可以提供精心构造的输入，从而篡改预期的 LDAP 查询，导致执行非预期的目录操作。
Possible ATT&CK Techniques 1 AI
T1110 · Brute ForceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Esri | Portal for ArcGIS | ≤ 12.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10759
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BUG-000171040 Portal for ArcGIS has a security vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Esri | Portal for ArcGIS | 0 ~ 12.2 | - |
|
II. Public POCs for CVE-2026-10759
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10759
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-10759 (1)
Same Patch Batch · Esri · 2026-10-13 · 3 CVEs total
| CVE-2026-69227 | 9.8 CRITICAL | BUG-000187331 Portal for ArcGIS has a security vulnerability |
| CVE-2026-69226 | 6.5 MEDIUM | Portal for ArcGIS has a security vulnerability |
IV. Related Vulnerabilities
Same product: Portal for ArcGIS
-
CVE-2026-69226
Portal for ArcGIS has a security vulnerability -
CVE-2026-69227
BUG-000187331 Portal for ArcGIS has a security vulnerability -
CVE-2026-69233
stored cross site scripting issue in Esri Portal for ArcGIS -
CVE-2026-69234
reflected cross site scripting vulnerability in Esri Portal -
CVE-2026-69235
stored cross site scripting issue in Esri Portal for ArcGIS
Same vendor: Esri
-
CVE-2026-69226
Portal for ArcGIS has a security vulnerability -
CVE-2026-69227
BUG-000187331 Portal for ArcGIS has a security vulnerability -
CVE-2026-10758
Esri Lerc has a security vulnerability -
CVE-2026-69233
stored cross site scripting issue in Esri Portal for ArcGIS -
CVE-2026-69234
reflected cross site scripting vulnerability in Esri Portal
Same weakness: CWE-90
-
CVE-2026-93635
Zimbra Collaboration Suite LDAP Filter Injection via Unescap -
CVE-2026-89071
MOVEit Transfer LDAP injection in certificate-based authenti -
CVE-2026-110256
Dockhand before 1.0.19 Username Enumeration via LDAP Injecti -
CVE-2025-71431
Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoin -
CVE-2026-109357
LibreNMS before 26.9.0 LDAP Filter Injection Authentication
V. Comments for CVE-2026-10759
No comments yet