Esri Portal for ArcGIS versions 12.1 and earlier contain a vulnerability classified as CWE-640, where a critical function related to password recovery lacks proper authentication. This allows remote attackers without any privileges to access an unprotected API endpoint, potentially leading to full compromise of the system. The vulnerability affects multiple platforms including Windows, Linux, and Kubernetes deployments. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided by the vendor as of the published date.

An unauthenticated remote attacker can exploit this vulnerability to access a critical API without authentication, potentially leading to full system compromise including unauthorized data access, modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability with maximum severity as indicated by the CVSS score of 9.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by Esri, organizations should monitor vendor communications closely. Until a patch is available, consider restricting network access to the Portal for ArcGIS management interfaces and APIs to trusted administrators only, and implement compensating controls such as network segmentation and enhanced monitoring for suspicious activity related to password recovery functions.