CVE-2026-13019

CriticalCVSS 9.8

Published: 07/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

A missing authentication for critical function vulnerability in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes allows a remote, unauthenticated attacker to access an unprotected API.

Risk Assessment

The organization is at risk of unauthorized access to sensitive GIS data and system functions, potentially leading to information disclosure or spatial data manipulation.

Recommendation

Immediately upgrade Esri Portal for ArcGIS to a version later than 12.1 and enforce authentication for all critical APIs.

Original NVD description (English source)

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API.