CVE-2026-13020CWE-640

Weak Password Recovery Mechanism in Portal for ArcGIS

High · published July 7, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.5th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-07-07T16:39Z
EPSS history
Timeline
  • 07 JUL 16:39Z
    Weak Password Recovery Mechanism in Portal for ArcGIS
    cvelistv5