Portal for ArcGIS CVE-2026-13019

The affected Portal for ArcGIS API endpoint must be network-reachable by the attacker (e.g., internet-facing or reachable within a routable network segment), and the instance must be running version 12.1 or earlier on Windows, Linux, or Kubernetes. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special client configuration are required - this is unauthenticated remote access against the API as shipped. The primary limiting factor is exposure: instances whose portal/API endpoints are firewalled to trusted networks or fronted by an authenticating proxy are not reachable by an arbitrary remote attacker, and already-patched instances are not affected. The specific vulnerable endpoint is not named in the available data, which limits precise scoping.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the worst-case profile: network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability - consistent with an unauthenticated, remotely reachable administrative function. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the data; the only exploitation signal is the vector's ease-of-access, not observed activity. This should be treated as a genuine high priority for internet-exposed or broadly-reachable Portal for ArcGIS instances because the barrier to exploitation is essentially zero, but the confidence in the full C/I/A=High rating is limited: the description only explicitly states an attacker can 'access an unprotected API' and does not detail what that API modifies or destroys, so the integrity and availability impacts are vendor-asserted rather than described. The CWE mismatch (640 vs. the described missing-auth behavior) is a data-quality flag to verify against the Esri bulletin.

An attacker scans for internet-exposed ArcGIS Portal instances and sends unauthenticated HTTP requests directly to the affected REST API endpoint, receiving a valid response without any login. Given AV:N/AC:L/PR:N, this requires only network reachability and no credentials or user interaction, allowing the attacker to invoke the exposed critical function to read or alter portal data or configuration. No public POC is identified at time of analysis, but the low complexity makes independent discovery straightforward once the endpoint is known.