This vulnerability (CVE-2026-13020) in Esri Portal for ArcGIS versions 12.1 and earlier concerns a weak password recovery mechanism for forgotten passwords. An attacker without privileges can remotely exploit this weakness to assume ownership of user accounts by manipulating the password recovery process. The issue affects multiple deployment platforms including Windows, Linux, and Kubernetes. Esri recommends configuring an email server with ArcGIS Enterprise to support secure user self-service password recovery. There is no indication of an official patch or fix available at this time.

Successful exploitation allows a remote, unauthorized attacker to assume ownership of user accounts, potentially leading to full compromise of affected accounts. This can result in complete loss of confidentiality, integrity, and availability of the user accounts and associated data within the Portal for ArcGIS environment.

No official patch or fix has been confirmed at this time. Administrators should configure an email server with ArcGIS Enterprise to enable user self-service password recovery, which may help mitigate the risk. The administrator's ability to reset user passwords remains unchanged and can be used as a manual recovery method. Monitor the vendor advisory for updates on remediation.