What is the CVSS score of CVE-2026-13019?

CVE-2026-13019 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Portal for ArcGIS are affected by CVE-2026-13019?

Esri Portal for ArcGIS versions 12.1 and earlier contain a critical authentication bypass allowing unauthenticated remote attackers to directly access administrative API endpoints and modify portal…. A patch is available.

How to fix or mitigate CVE-2026-13019?

WITHIN 24 HOURS: Inventory all Esri Portal for ArcGIS instances running version 12.1 or earlier; immediately restrict network access via firewall rules and network segmentation to limit exposure to administrative subnets only. WITHIN 7 DAYS: Deploy continuous monitoring and alerting for exploitation attempts against administrative API endpoints; implement Web Application Firewall (WAF) rules to block unauthenticated API requests if architecturally feasible; establish daily contact with Esri support for patch release timeline. WITHIN 30 DAYS: Test and execute upgrade to Portal for ArcGIS 12.2 or later (upon patch verification); for instances unable to upgrade within 30 days, deploy defense-in-depth: VPN/bastion access controls, mandatory multi-factor authentication for all portal users, and API gateway authentication enforcement independent of Portal's native controls.

Portal for ArcGIS CVE-2026-13019

EUVD-2026-42058 CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-07-07 Esri

GHSA-6rrr-4jqj-5947

Authentication Bypass Kubernetes Microsoft Portal For Arcgis Esri

9.8

CVSS 3.1 · Vendor: Esri

Severity by source

Vendor (Esri) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unprotected network API with no auth or interaction gives AV:N/AC:L/PR:N/UI:N; C/I/A retained High as the exposed function is critical/administrative, though I and A are inferred from vendor rating.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Esri).

CVSS VectorVendor: Esri

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 18:01 EUVD

Analysis Generated

Jul 07, 2026 - 17:23 vuln.today

CVE Published

Jul 07, 2026 - 16:40 nvd

CRITICAL 9.8

DescriptionCVE.org

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API.

Articles & Coverage 2

News 3 New Kubernetes Vulnerabilities - 1 Critical, 2 High Severity Jul 08, 2026 News Critical Authentication Bypass in Esri Portal for ArcGIS (Kubernetes) - CVE-2026-13019 Jul 07, 2026

AnalysisAI

Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a critical API endpoint that a remote, unauthenticated attacker can reach directly, bypassing access controls to interact with functionality that should require an authenticated session. Esri rates this critical (CVSS 9.8) and disclosed it in its June 2026 ArcGIS security bulletin; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the exposed function is an administrative/portal API reachable over the network with no credentials, successful access could lead to disclosure or manipulation of portal content and configuration.

Technical ContextAI

Portal for ArcGIS is the enterprise web-GIS component of the ArcGIS Enterprise stack, providing hosted maps, apps, user/content management, and administrative REST APIs, and it can be deployed on Windows, Linux, or Kubernetes. The flaw is an access-control gap where at least one API endpoint that performs a critical/privileged function is served without enforcing authentication, matching the CWE-306 'Missing Authentication for Critical Function' pattern described in the advisory. Note the input assigns CWE-640 (Weak Password Recovery Mechanism), which is inconsistent with the description of an unprotected API - the described behavior is authentication bypass, not password-recovery weakness, so the CWE mapping should be treated as questionable. Because the affected surface is the network-exposed REST API layer, any deployment mode (single-machine, distributed, or containerized on Kubernetes) that publishes the portal endpoint is in scope.

RemediationAI

Apply the update referenced in Esri's June 2026 ArcGIS security bulletin (https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/june-2026-arcgis-security-bulletin); a patch is available per the vendor advisory, but the exact fixed version is not specified in the available data and must be taken directly from the bulletin - do not assume a version number. Until patched, reduce exposure by removing the Portal for ArcGIS administrative and API endpoints from direct internet reachability and placing them behind the ArcGIS Web Adaptor or a reverse proxy/WAF that can restrict or authenticate access, and use network ACLs or firewall rules to limit the portal API to trusted management networks and known client ranges (trade-off: may break remote administration and any external integrations that call the API directly). For Kubernetes deployments, tighten Ingress rules and NetworkPolicies so the portal service is not exposed cluster-wide or externally. Because the specific vulnerable endpoint is not named in the source data, blanket network restriction is the most reliable compensating control until the exact fix version is applied.