CVE-2026-13020 Weak Password Recovery Mechanism in Portal for ArcGIS

What is CVE-2026-13020?

CVE-2026-13020 is a high-severity authentication bypass vulnerability in Esri Portal for Arcgis, published on 7 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

Weakness: CWE-640

Which versions are affected by CVE-2026-13020?

It affects 1 product.

Products include Esri Portal for Arcgis.

How do I fix CVE-2026-13020?

No fix has been published for CVE-2026-13020 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-13020 being exploited?

There is no known exploitation of CVE-2026-13020 in the wild and no public exploit code.

Other vulnerabilities in Esri Portal for Arcgis

• CVE-2024-25693 Portal for ArcGIS has a directory traversal vulnerability. Critical 9.9
• CVE-2026-13019 Missing Authentication Critical 9.8
• CVE-2026-33518 Incorrect privilege assignment in Portal for ArcGIS Critical 9.8
• CVE-2026-33519 Incorrect privilege assignment in Portal for ArcGIS Critical 9.8
• CVE-2025-2538 BUG-000174336 Critical 9.8

All Esri Portal for Arcgis vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j3v3-cjmx-765g.