Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 4 products
| Date | Total | Labels |
|---|
| 2026-07-07 | 2 | Disclosure1Patch1 |
| 2026-07-08 | 1 | Disclosure1 |
| 2026-07-10 | 1 | Disclosure1 |
🚨 CVE-2026-13019 — CVSS 9.8/10 ██████████ Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/ePHdXbVrg2
Post summary
CVE-2026-13019 is a critical missing authentication flaw in Esri Portal for ArcGIS, and a patch is available immediately.
🚨 CRITICAL: ArcGIS Portal 2-CVE Cluster — CVSS 9.8 + 8.1 CVE-2026-13019: Missing authentication → unauthenticated API access CVE-2026-13020: Weak password recovery → account takeover → http://threataft.com/articles/arcgis-portal-cve-2026-13019-13020-auth-bypass #cybersecurity #infosec #ArcGIS #GIS
Post summary
The notice announces two critical ArcGIS Portal vulnerabilities (CVE-2026-13019 and CVE-2026-13020), highlighting missing authentication and weak password recovery that could allow unauthenticated API access and account takeover.
CVE-2026-13019 - Critical missing authentication in Esri Portal for ArcGIS (v12.1 & earlier). Unprotected API allows unauthenticated remote access. CVSS 9.8. No patch yet - mitigate with network controls. #CVE #Esri #infosec #devsecops #developers #redteam #blueteam #hackers https://www.valtersit.com/cve/CVE-2026-13019
Post summary
The post announces a critical authentication bypass in Esri Portal for ArcGIS (CVSS 9.8) with no patch yet, advising mitigation via network controls.
🚨Critical - Esri Portal for ArcGIS Unauthenticated API Access (CVE-2026-13019) Esri Portal for ArcGIS (versions 12.1 and earlier, on Windows, Linux, and Kubernetes) contains a missing-authentication-for-critical-function flaw: a remote, unauthenticated attacker can reach an unprotected API endpoint with no credentials. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this exposes a critical function of the enterprise GIS portal to anyone who can reach it over the network. (The assigned CWE-640 vs the "missing authentication" description is a slight mismatch - the exploitable issue is unauthenticated API access.) 👉Update per Esri's June 2026 ArcGIS security bulletin (affects Portal for ArcGIS ≤ 12.1).
Post summary
The text announces CVE‑2026‑13019, detailing an unauthenticated API access flaw in Esri Portal for ArcGIS with a CVSS of 9.8 and references an upcoming Esri security bulletin.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | esri | portal_for_arcgis | - | - | - |
| App | kubernetes | kubernetes | - | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |