CVE-2026-10759
MediumCVSS 5.5Summary
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.
Risk Assessment
An administrator could perform unauthorized operations in the LDAP/Active Directory, potentially leading to disclosure or modification of directory data. However, this requires administrative privileges, limiting the pool of potential attackers.
Recommendation
Apply available security updates for Portal for ArcGIS. Additionally, implement input validation and neutralization in LDAP queries.
Other vulnerabilities in Portal for ArcGIS
See all- CVE-2026-69226Medium
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.
- CVE-2026-69227Critical
A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Original NVD description (English source)
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS