CVE-2026-13020: Weak Password Recovery Mechanism in Portal for ArcGIS
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery (for Portal for ArcGIS 12.1 and earlier on Windows, Linux, and Kubernetes). Keep the administrator password reset capability unchanged.
Esri Portal for ArcGIS configure email server for user self-service password recovery = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13020?
CVE-2026-13020 has a severity rating of 8.1, which is classified as high.
How do I fix CVE-2026-13020?
To mitigate CVE-2026-13020, Esri Portal for ArcGIS administrators should implement stronger password recovery mechanisms and enforce robust security practices.
What versions are affected by CVE-2026-13020?
CVE-2026-13020 affects Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux, and Kubernetes.
What impact does CVE-2026-13020 have on users?
CVE-2026-13020 allows remote, unauthorized attackers to potentially take over user accounts by exploiting the weak password recovery mechanism.
Is there a workaround for CVE-2026-13020?
Currently, the best preventive measure against CVE-2026-13020 is to improve the password recovery process and user authentication methods in Esri Portal for ArcGIS.