CVE-2026-10759: BUG-000171040 Portal for ArcGIS has a security vulnerability
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated as an administrator of Portal for ArcGIS. The issue is limited to administrative functionality that builds Active Directory or LDAP search queries.
What access and conditions are required for exploitation?
The attacker needs network access to the affected Portal for ArcGIS environment and valid administrative privileges. No user interaction is required, and the attacker must be able to submit crafted input to the relevant administrative LDAP or Active Directory query functionality.
What is the potential impact?
Crafted input can alter the intended LDAP query and lead to unintended directory operations. The reported impact includes high confidentiality impact and low integrity impact, with no availability impact indicated.