High SEVERITY — Vulnerability

CVE-2026-13020 — A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

Platform
Windows Server
CVE Record
CVE-2026-13020
CVSS Score
8.1/10
Published
07 July 2026
Views
36
Primary source: Review the official advisory at nvd.nist.gov Go to Source

Summary

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

Assessment

  • CVE: CVE-2026-13020
  • CVSS taban puanı: 8.1
  • Vektör: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Kaynak: NVD kaydı

References

Action

  • Etkilenen sistemleri envanterden doğrulayın
  • Üretici yamasını bakım penceresinde uygulayın
  • Yama uygulanana kadar erişimi ağ katmanında kısıtlayın
portal for arcgis * kubernetes - linux kernel - windows -

Windows Server — Related Advisories

VIEW ALL →