Missing Authentication in Esri Portal for ArcGIS

Publication date: 2026-07-07

Last updated on: 2026-09-29

Assigner: Environmental Systems Research Institute, Inc.

Description

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-07-07

EPSS Evaluated

2026-10-14

NVD

CVE-2026-13019

EUVD

EUVD-2026-42058

Affected Vendors & Products

Vendor	Product	Version / Range
esri	portal_for_arcgis	to 12.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux, and Kubernetes platforms. It is caused by missing authentication for a critical function, which allows a remote attacker who is not authenticated to access an unprotected API.

Impact Analysis

Because the vulnerability allows remote, unauthenticated access to a critical API, it can lead to severe impacts including full compromise of confidentiality, integrity, and availability of the affected system.

Hi! I’m here to help you understand CVE-2026-13019. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70