CVE-2026-13020: Esri Portal ArcGIS Auth Bypass Flaw

CVE-2026-13020 Overview

CVE-2026-13020 is a weak password recovery mechanism vulnerability in Esri Portal for ArcGIS versions 12.1 and earlier. The flaw affects deployments running on Windows, Linux, and Kubernetes platforms. A remote, unauthenticated attacker can manipulate the forgotten password mechanism to take over user accounts. The vulnerability is tracked under [CWE-640: Weak Password Recovery Mechanism for Forgotten Password]. Esri disclosed the issue in the June 2026 ArcGIS Security Bulletin. Administrators retain the ability to reset user passwords directly, but the self-service recovery flow requires an email server configured with ArcGIS Enterprise to mitigate the risk.

Critical Impact
Remote attackers can assume ownership of any Portal for ArcGIS user account without authentication, including administrator accounts, resulting in full compromise of geospatial data and enterprise workflows.

Affected Products

Esri Portal for ArcGIS versions 12.1 and earlier on Microsoft Windows
Esri Portal for ArcGIS versions 12.1 and earlier on Linux
Esri Portal for ArcGIS versions 12.1 and earlier on Kubernetes

Discovery Timeline

2026-07-07 - CVE-2026-13020 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-13020

Vulnerability Analysis

The vulnerability resides in the forgotten password workflow of Esri Portal for ArcGIS. The password recovery mechanism does not sufficiently validate the identity of the requester before permitting a credential reset. An unauthenticated remote attacker can manipulate the workflow to assume control of arbitrary accounts, including privileged administrators. Because Portal for ArcGIS often federates identity across ArcGIS Server, ArcGIS Enterprise, and hosted content, account takeover cascades into loss of confidentiality, integrity, and availability across the entire geospatial platform.

Root Cause

The root cause is classified as [CWE-640]: a weak password recovery mechanism for forgotten passwords. The recovery flow relies on data or tokens that an attacker can predict, replay, or manipulate rather than requiring an out-of-band verification channel. When ArcGIS Administrators have not configured an email server with ArcGIS Enterprise, self-service recovery falls back to a state that permits abuse. The mechanism fails to bind reset operations to a verified user-controlled channel.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker submits a crafted password reset request against a Portal for ArcGIS instance exposed over HTTP or HTTPS. By manipulating parameters in the recovery workflow, the attacker completes the reset for a targeted account. No client-side interaction from the legitimate user is required. Public-facing ArcGIS Portal deployments are directly reachable and therefore at highest risk.

The vulnerability manifests in the password recovery endpoint logic. See the Esri ArcGIS Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-13020

Indicators of Compromise

Password reset requests targeting administrator or high-privilege Portal accounts from unfamiliar source IP addresses.
Successful authentication events for user accounts immediately following a password reset that the account owner did not initiate.
Anomalous changes to user profile fields, recovery email addresses, or federated identity settings in Portal for ArcGIS logs.
Bulk enumeration of usernames via the forgotten password interface.

Detection Strategies

Review Portal for ArcGIS web server access logs for repeated calls to the sharing/rest/community/users and password reset endpoints.
Correlate password reset events with subsequent logins, content sharing changes, and privilege modifications within a short time window.
Alert on password reset requests originating from IP ranges outside expected administrator geographies.

Monitoring Recommendations

Forward ArcGIS Enterprise, Portal, and reverse proxy logs to a centralized SIEM for continuous analysis.
Monitor Kubernetes audit logs for Portal for ArcGIS pods when deployed on ArcGIS Enterprise on Kubernetes.
Track outbound traffic from Portal servers for signs of data exfiltration following suspected account takeover.

How to Mitigate CVE-2026-13020

Immediate Actions Required

Upgrade Esri Portal for ArcGIS to a fixed version above 12.1 as directed in the June 2026 Esri security bulletin.
Configure an email server with ArcGIS Enterprise so that user self-service password recovery is bound to a verified email channel.
Force password resets and session invalidation for all Portal for ArcGIS accounts, prioritizing administrators.
Audit recent password reset activity and user role assignments for unauthorized changes.

Patch Information

Esri published remediation guidance in the June 2026 ArcGIS Security Bulletin. Administrators should apply the vendor-provided update for Portal for ArcGIS across Windows, Linux, and Kubernetes deployments. The administrator-initiated password reset function remains unchanged and unaffected by the update.

Workarounds

Restrict network access to Portal for ArcGIS behind a VPN or reverse proxy with strict IP allowlisting until patches are applied.
Enable multi-factor authentication through a federated identity provider (SAML or OpenID Connect) to reduce impact of credential reset abuse.
Disable public access to the forgotten password endpoint via web application firewall rules where feasible.
Increase logging verbosity on the Portal for ArcGIS password reset workflow to support forensic review.

bash

# Example WAF rule concept to restrict access to the password recovery endpoint
# Block or restrict POST requests to the sharing/rest password reset paths
location ~* /sharing/rest/community/(resetPassword|forgotPassword) {
    allow 10.0.0.0/8;      # internal admin network
    deny  all;
    proxy_pass https://portal-backend;
}