CVE-2026-13020

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/june-2026-arcgis-security-bulletin	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*

OR	cpe:2.3:a:kubernetes:kubernetes:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Un mecanismo débil de recuperación de contraseña para contraseñas olvidadas existe en Esri Portal for ArcGIS versiones 12.1 y anteriores en Windows, Linux y Kubernetes. Un atacante remoto y no autorizado puede asumir la propiedad de la cuenta de un usuario manipulando este mecanismo. Los administradores de ArcGIS deben configurar un servidor de correo electrónico con ArcGIS Enterprise para facilitar la recuperación de contraseña de autoservicio del usuario. La capacidad de un administrador para restablecer la contraseña de un usuario permanece sin cambios.

Information

Published : 2026-07-07 17:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-13020

Mitre link : CVE-2026-13020

CVE.ORG link : CVE-2026-13020

JSON object : View

Products Affected

linux

linux_kernel

microsoft

windows

esri

portal_for_arcgis

kubernetes

kubernetes

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2026-13020", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13020", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-07T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@esri.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@esri.com", "affectedData": [{"vendor": "Esri", "product": "Portal for ArcGIS", "versions": [{"status": "affected", "version": "0", "lessThan": "12.1", "versionType": "custom"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-07-07T17:16:35.510", "references": [{"url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/june-2026-arcgis-security-bulletin", "tags": ["Vendor Advisory"], "source": "psirt@esri.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@esri.com", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user\u2019s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user\u2019s password remains unchanged."}, {"lang": "es", "value": "Un mecanismo d\u00e9bil de recuperaci\u00f3n de contrase\u00f1a para contrase\u00f1as olvidadas existe en Esri Portal for ArcGIS versiones 12.1 y anteriores en Windows, Linux y Kubernetes. Un atacante remoto y no autorizado puede asumir la propiedad de la cuenta de un usuario manipulando este mecanismo. Los administradores de ArcGIS deben configurar un servidor de correo electr\u00f3nico con ArcGIS Enterprise para facilitar la recuperaci\u00f3n de contrase\u00f1a de autoservicio del usuario. La capacidad de un administrador para restablecer la contrase\u00f1a de un usuario permanece sin cambios."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "587ADE6F-C9ED-46CD-92F0-0559E73C004B", "versionEndIncluding": "12.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:kubernetes:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "14C32308-314D-4E0D-B15F-6A68DF21E9F9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@esri.com"}