Wednesday September 16, 2026

ngCERT SECURITY ADVISORY ON CRITICAL AUTHENTICATION BYPASS VULNERABILITY IN ESRI PORTAL FOR ARCGIS

Advisory ID:   ngCERT-2026-080005

Damage:      Critical 

Probability:  High

Platform(s):  Windows, Linux, and Kubernetes (Esri Portal for ArcGIS)

SUMMARY

  ngCERT warns organisations using Esri Portal for ArcGIS of a critical authentication bypass vulnerability tracked as CVE-2026-13019. The flaw affects Portal for ArcGIS versions 12.1 and earlier running on Windows, Linux, and Kubernetes. A remote, unauthenticated attacker can access an unprotected API endpoint without any credentials or user interaction. The vulnerability carries a CVSS v3.1 score of 9.8 (Critical). Esri has released a security patch, and all affected organisations are strongly advised to apply it immediately.

DESCRIPTION

CVE-2026-13019 is a missing authentication for a critical function vulnerability (CWE-306 / CWE-640) in Esri Portal for ArcGIS. An API endpoint within the product lacks proper authentication controls, allowing a remote attacker to invoke it without providing valid credentials. Successful exploitation requires no privileges and user interaction. Since the vulnerable endpoint is network-accessible, attackers can exploit it remotely over the internet or internal networks. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Esri published the fix in the Portal for ArcGIS Security 2026 Update 2 Patch (released June 2026).

CONSEQUENCES

Successful exploitation of CVE-2026-13019 may result in:

    1. Unauthorised access to critical API functions.
    2. Compromise of sensitive geospatial and organisational data.
    3. Potential modification or deletion of portal content and configurations.
    4. Full impact on system confidentiality, integrity, and availability.
    5. Possible further lateral movement within the network. 

SOLUTION/MITIGATION

ngCERT recommends the following:

    1. Immediately apply the Portal for ArcGIS Security 2026 Update 2 Patch released by Esri.
    2. Upgrade to a fixed version of Portal for ArcGIS as advised by the vendor.
    3. Restrict network access to the Portal for ArcGIS management and API interfaces using firewalls or network segmentation.
    4. Monitor logs for any unauthenticated API access attempts.
    5. Conduct a security assessment of all ArcGIS Portal deployments.
    6. Implement the principle of least privilege and multi-factor authentication where possible.
    7. Report any confirmed exploitation or related incidents to ngCERT for further assistance and coordination.  

HYPERLINK