CVE-2026-10759
Received Received - Intake

LDAP Injection in Portal for ArcGIS

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Environmental Systems Research Institute, Inc.

Description
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-10759
EUVD
EUVD-2026-98844

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Esri Portal for ArcGIS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-90 The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an LDAP injection flaw in Portal for ArcGIS. It occurs because administrative functions build Active Directory or LDAP search queries without properly neutralizing user input. An authenticated admin could craft malicious input to alter the LDAP query, leading to unintended directory operations.

Detection Guidance

Detecting LDAP injection flaws like this requires reviewing administrative logs for unusual query patterns, especially those involving crafted input that modifies LDAP search queries. Check ArcGIS Portal administrative interfaces for unexpected directory operations or failed authentication attempts.

Impact Analysis

An attacker with admin access could manipulate LDAP queries to perform unauthorized directory operations, potentially exposing sensitive user data or altering directory contents. This could lead to data breaches or unauthorized access to resources.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Apply patches or updates from Esri to address the LDAP injection flaw. Restrict administrative access to trusted users only. Monitor LDAP query logs for suspicious activity and review input validation mechanisms in Portal for ArcGIS administrative functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart