CVE-2026-13019 CRITICAL

CVE-2026-13019: Missing Authentication

Vendor Esri

Product Portal for ArcGIS

Weakness CWE-640 · Weak password recovery

Published July 7, 2026

Last update July 7, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API.

Key dates

02Disclosure timeline

July 7, 2026 CVE published

July 7, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-13019 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/640.html AskarLabs — CWE-640 write-up Weak Password Recovery Mechanism for Forgotten Password

Related vulnerabilities

04Related CVE

CVE-2024-9305 AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP CVE-2024-11103 Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover CVE-2026-66691 WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability CVE-2025-47646 WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability CVE-2024-9302 App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP