Portal for ArcGIS CVE-2026-10759

Requires an authenticated account with administrative privileges on Portal for ArcGIS, and the specific administrative functionality that constructs Active Directory/LDAP search queries must be in use - i.e., the portal must be configured to integrate with an external AD/LDAP identity store for directory searches. Exploitation is limited by this high privilege requirement (PR:H): only users who can already reach administrative directory-configuration features can trigger it, so deployments where Portal admin access is tightly restricted and/or that use built-in (non-LDAP) identity stores are materially less exposed. No end-user interaction is required (UI:N) and the vector is network-reachable with low complexity once admin access is held.

This is a moderate-severity, operationally-constrained flaw rather than a top-tier emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N, base 5.5) is internally consistent with the description: network-reachable but gated behind high privileges (PR:H), since only an authenticated administrator can reach the vulnerable directory-search functionality. No EPSS probability, CISA KEV entry, or public POC was provided in the intelligence set, so there is no signal of active or imminent widespread exploitation; status is best characterized as no public exploit identified at time of analysis. The combination of PR:H plus the absence of KEV/EPSS data strongly suggests this is NOT a mass-exploitation priority - an attacker must already hold administrative access to Portal for ArcGIS, which both limits the attacker population and means the primary added risk is privilege misuse (e.g., an admin pivoting into the backing directory) rather than external compromise. Note a tension worth flagging: C:H (high confidentiality) implies the injection can exfiltrate significant directory data, yet I:L and A:N suggest limited write/availability impact - verify with Esri whether crafted queries can enumerate or extract full AD/LDAP records versus merely altering query logic. No SSVC decision data was supplied. Overall: real but conditional risk; prioritize patching where Portal admin access is broadly delegated or where the portal binds to a sensitive enterprise Active Directory.

An authenticated Portal for ArcGIS administrator (or an attacker who has compromised admin credentials) submits crafted input into an administrative feature that builds an LDAP/Active Directory search filter, injecting special characters that alter the filter logic. Because the query is not sufficiently neutralized, the modified filter returns or operates on directory entries beyond the intended scope, potentially disclosing sensitive AD account data. Exploitation is network-reachable with low complexity but requires valid high-privilege credentials; no public exploit code was identified in the provided data.