CVE-2026-13020 is a high severity flaw (CVSS 8.1) in Esri Portal for ArcGIS 12.1 and earlier on Windows, Linux and Kubernetes. The forgotten password mechanism can be manipulated to take over a user account. Esri tells administrators to configure an email server for self service password recovery.
What's affected
Per the record, Portal for ArcGIS versions 12.1 and earlier are affected on Windows, Linux and Kubernetes. The record names no fixed version. The Esri June 2026 ArcGIS security bulletin is the reference. It refused our automated request, so open it in a browser to read the patch or update guidance for your release.
The record states one mitigation: administrators should configure an email server with ArcGIS Enterprise so users can recover passwords themselves. An administrator resetting a user password works as before.
How to check if you're exposed
Check the Portal version from the Portal Administrator Directory or the ArcGIS Enterprise version shown in the install. Then answer one question: is an email server configured for your Enterprise deployment? Per the record, that setting is the thing the advisory asks administrators to put in place.
Also review recent password reset activity for accounts that should not have changed, especially administrator accounts.
What to do now
- Read the Esri June 2026 ArcGIS security bulletin in a browser and note any patch for your version.
- Configure an email server for ArcGIS Enterprise so self service password recovery works as designed.
- Apply any patch the bulletin lists.
- Audit password reset events and recent logins for privileged Portal accounts.
- Keep the Portal off the open internet where you can, or place it behind a reverse proxy with access controls.
Why it matters
Password recovery is a second login path. If it can be steered, the strength of the password does not matter. The weakness class is weak password recovery for forgotten passwords. The record does not describe the exact manipulation, and neither will we.
The score is high rather than critical because the vector marks attack complexity as high. Confidentiality, integrity and availability are all rated high, which fits account takeover of a platform that holds maps, data and sharing settings. The record does not flag this CVE as known exploited.
The record lists this weakness class: CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).
Quick check
Is a patch version named in the record?
No. The record gives only the affected range and the email server mitigation. Use the Esri bulletin for patch details.
Sources
Last reviewed: 19 October 2026.
