CVE-2026-13020
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD
Description
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.
Affected (1)
Products: Esri: Portal For Arcgis
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 12.1 |
| Running on/with | Platform Versions |
|---|---|
Kubernetes Kubernetes | All versions |
Linux Linux Kernel | All versions |
Microsoft Windows | All versions |
References (1)
Source: psirt@esri.com
Vendor Advisory
Timeline
No history available yet.