EUVD-2026-42057
GHSA-j3v3-cjmx-765g
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password recovery security
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten-password recovery mechanism (CWE-640) that a remote, unauthenticated attacker can manipulate to assume ownership of another user's account. The flaw carries a CVSS 9.8 rating because it is network-reachable with no authentication or user interaction, yielding full compromise of confidentiality, integrity, and availability of the targeted account. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), and CISA's SSVC framework records exploitation as none, indicating no observed in-the-wild activity despite the critical score.
Earlier versions of this analysis (2)
Account takeover in Esri Portal for ArcGIS (versions 12.1 and earlier on Windows, Linux, and Kubernetes) allows a remote, unauthenticated attacker to hijack another user's account by abusing the forgotten-password self-service flow. Rated CVSS 9.8, the flaw stems from a weak password-recovery mechanism (CWE-640) rather than a memory-safety bug, and requires no user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and CISA's SSVC framework records exploitation status as 'none,' indicating no observed in-the-wild activity despite the high base score.
Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, Kubernetes) allows a remote, unauthenticated attacker to hijack another user's account by abusing a weak forgotten-password recovery mechanism (CWE-640). Because the flaw lets an attacker seize ownership of an existing account, it grants full read/write control over that user's ArcGIS content and identity. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the network-reachable, pre-authentication nature makes it a meaningful risk for internet-exposed Enterprise portals.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Portal For Arcgis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote reset abuse (PR:N/UI:N/AV:N/AC:L) yields full account takeover; C:H/I:H, and A:H since the victim is locked out after password change.
Primary rating from Vendor (Esri).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.
Articles & Coverage 1
Executive ViewAI
Esri Portal for ArcGIS versions 12.1 and earlier contain a critical account takeover vulnerability in the password recovery mechanism that exposes all user accounts to unauthorized access by remote, unauthenticated attackers. Compromised accounts grant full control over user access, threatening the confidentiality and integrity of geospatial data and analyses that support critical organizational decisions. Although no current exploitation is observed, immediate patching is required given the severity and ease of exploitation.
Within 24 hours: Inventory all Esri Portal for ArcGIS deployments and identify systems running version 12.1 or earlier across Windows, Linux, and Kubernetes environments. Within 7 days: Deploy vendor security patch to all identified instances. Within 30 days: Conduct post-patch security validation and review access logs for suspicious account recovery activity prior to patch deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Portal For Arcgis
View allThere is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Rated critical severity (CVSS 9.9), this vulnerabi
Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a
Unauthenticated access to administrative API endpoints in Esri Portal for ArcGIS can let remote attackers reach /portala
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 an
Broken access control in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 (Windows, Linux, and Kubernetes) fails to correctly
There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, una
There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 a
There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS version
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may all
There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that
Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 allows remote unauthenticated attackers to e
Exploit-DB