CVE-2026-13019: esri portal for arcgis

csirt@kutim:~/threat-intel/cve/CVE-2026-13019

CVSS 9.8 · Critical EPSS 0,85%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada esri portal for arcgis. Skor CVSS 3.1 9.8 (Critical) menurut esri.com.

Deskripsi (NVD)

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability.

Rincian

Terbit di NVD: 7 Juli 2026
Terakhir diubah: 29 September 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber esri.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-640: Weak Password Recovery Mechanism for Forgotten Password
EPSS (30 hari): 0,85% peluang dieksploitasi; lebih tinggi dari 56,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
esri	portal for arcgis	Semua versi hingga 12.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/june-2026-arcgis-security-bulletin advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.