Esri ArcGIS Portal for ArcGIS CVE-2026-13020/13019 Vulnerability Advisory

Vulnerability Overview Vulnerability Name: CVE-2026-13020 and CVE-2026-13019 Description: - CVE-2026-13020: A weak password recovery mechanism that allows a remote, unauthenticated attacker to take over user accounts by manipulating the password recovery process. - CVE-2026-13019: Missing authentication for critical functionality, allowing a remote, unauthenticated attacker to access unprotected APIs. Affected Versions Affected Versions: ArcGIS Portal for ArcGIS 12.1 and earlier Operating Systems: Windows, Linux, and Kubernetes Remediation Patch Release: Portal for ArcGIS Security 2026 Update 2 Patch Release Date: June 23, 2026 Recommended Actions: - Apply the patch immediately to minimize risk. - Implement email verification for account changes using SMTP. - Use a centralized identity provider as the primary authentication mechanism. - Require Multi-Factor Authentication (MFA) for administrative account logins. - Keep the application updated to the latest version. Patch Details CVE-2026-13020: - CWE: CWE-640: Weak Password Recovery Mechanism for Authentication - CVSSv3.1: 8.1 - Temporal CVSSv3.1: 7.7 CVE-2026-13019: - CWE: CWE-306: Missing Authentication for Critical Function - CVSSv3.1: 9.8 - Temporal CVSSv3.1: 9.4 Patch Notes Patch Nature: Cumulative patch; no previous patches are required for installation. Potential Impact: - If email is not enabled on the site, administrators are responsible for resetting user passwords. - If email is enabled on the site, users can reset passwords via an email-based process. - No changes for users authenticating via SAML/OpenID Connect/LDAP or Windows users. Additional Recommendations Implement SMTP for email verification. Use a centralized identity provider. Require MFA for administrative accounts. Keep the application updated. Consider using a managed provider or SaaS. Summary Esri has released the Portal for ArcGIS Security 2026 Update 2 Patch, which resolves two critical vulnerabilities (CVE-2026-13020 and CVE-2026-13019). Users are advised to apply the patch immediately and implement additional security measures, such as SMTP verification, centralized identity providers, and MFA, to enhance system security.

Goal Reached Thanks to every supporter — we hit 100%!

Esri ArcGIS Portal for ArcGIS CVE-2026-13020/13019 Vulnerability Advisory