CVE-2026-13019: Esri Portal ArcGIS Auth Bypass Flaw

CVE-2026-13019 Overview

CVE-2026-13019 is a missing authentication for critical function vulnerability [CWE-640] in Esri Portal for ArcGIS versions 12.1 and earlier. The flaw exposes an unprotected API that remote, unauthenticated attackers can reach over the network. The vulnerability affects deployments on Windows, Linux, and Kubernetes.

Esri published the fix in its June 2026 ArcGIS Security Bulletin. The vulnerability carries a CVSS 3.1 base score of 9.8 due to network-based exploitation without authentication and full impact to confidentiality, integrity, and availability.

Critical Impact
A remote, unauthenticated attacker can invoke an unprotected API in Portal for ArcGIS, enabling access to sensitive functionality across confidentiality, integrity, and availability.

Affected Products

Esri Portal for ArcGIS versions 12.1 and earlier
Deployments on Microsoft Windows and Linux hosts
Deployments on Kubernetes

Discovery Timeline

2026-07-07 - CVE-2026-13019 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in the NVD database
June 2026 - Esri publishes the ArcGIS Security Bulletin addressing the issue

Technical Details for CVE-2026-13019

Vulnerability Analysis

Portal for ArcGIS is the on-premises component of the ArcGIS Enterprise stack that hosts maps, apps, and content sharing services. The product exposes a REST API surface used by administrators, developers, and portal users.

One API endpoint in versions 12.1 and earlier does not enforce authentication for a security-relevant function. Because the endpoint is reachable over the network without credentials, an attacker can invoke it directly and bypass the portal's access control model.

The issue is classified under [CWE-640], which covers weak or missing recovery and authentication mechanisms for critical functions. Successful exploitation grants an attacker the same effective access as a legitimate authenticated caller of that function.

Root Cause

The root cause is missing authentication enforcement on an API route that performs a critical operation. Access control checks that should gate the function are absent, so the server processes requests based only on their content.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable endpoint of an internet-reachable or intranet-reachable Portal for ArcGIS instance. No user interaction, prior authentication, or elevated privileges are required. Refer to the Esri ArcGIS Security Bulletin for the specific endpoint details and remediation guidance.

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported. The EPSS probability at publication is approximately 0.41%.

Detection Methods for CVE-2026-13019

Indicators of Compromise

Unauthenticated HTTP requests to Portal for ArcGIS REST API paths returning 200 OK without a preceding token exchange against /portal/sharing/rest/generateToken.
Portal audit log entries showing privileged operations without an associated username or session identifier.
Requests to the portal API from unexpected source IPs, cloud ranges, or anonymizer networks.

Detection Strategies

Compare portal access logs against expected authentication flows and alert on API calls that lack a valid token parameter or Authorization header.
Correlate reverse proxy or load balancer logs with Portal for ArcGIS logs to identify API calls that never traversed the login endpoint.
Deploy web application firewall rules to inspect requests targeting the Portal for ArcGIS sharing/rest API and block anonymous access to administrative routes.

Monitoring Recommendations

Forward Portal for ArcGIS logs, IIS or Nginx access logs, and Kubernetes ingress logs to a central SIEM for correlation.
Track version and patch level of every ArcGIS Enterprise deployment and alert when a host reports version 12.1 or earlier.
Monitor egress from portal hosts for unexpected outbound connections that could indicate post-exploitation activity.

How to Mitigate CVE-2026-13019

Immediate Actions Required

Inventory all Portal for ArcGIS instances across Windows, Linux, and Kubernetes deployments and identify any running version 12.1 or earlier.
Apply the patch referenced in the June 2026 ArcGIS Security Bulletin as soon as change windows allow.
Restrict network exposure of Portal for ArcGIS administrative interfaces to trusted management networks until patching is complete.
Review portal audit logs for anomalous unauthenticated API activity dating back to before the disclosure.

Patch Information

Esri addressed CVE-2026-13019 in the update associated with the June 2026 ArcGIS Security Bulletin. Administrators should upgrade Portal for ArcGIS beyond version 12.1 following Esri's documented upgrade procedure for their platform (Windows, Linux, or Kubernetes).

Workarounds

Place Portal for ArcGIS behind an authenticating reverse proxy that requires valid credentials before forwarding requests to the API.
Block external access to the vulnerable API path at the perimeter until the patch is applied.
Enforce IP allowlists on the web adaptor or Kubernetes ingress for administrative API routes.

bash

# Example: temporarily block anonymous access to the portal sharing API at an Nginx reverse proxy
location /portal/sharing/rest/ {
    if ($arg_token = "") {
        return 403;
    }
    proxy_pass https://portal-backend;
}