EXPOSURES › CVE-2026-13020

CVE-2026-13020

HIGH

DETAIL

SourceNVD · cve Published2026-07-07 CVSS8.1 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-13020 ↗

SHAME 25/100

▸ RECOMMENDED ACTION Patch the affected products and confirm your instances are covered.

PLAYERS IMPLICATED

ESRI · vendor Microsoft · vendor kubernetes · vendor linux · vendor kubernetes · product linux kernel · product portal for arcgis · product windows · product

DESCRIPTION

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

AFFECTED FEDRAMP PRODUCTS · 7

PRODUCT	PROVIDER	STATUS	MATCH
ArcGIS Online (AGO) ESRI	ESRI	Authorized	vendor-exact · 0.90
ArcGIS Online (AGO) Moderate ESRI	ESRI	In Process	vendor-exact · 0.90
Azure Commercial Cloud Microsoft	Microsoft	Authorized	vendor-exact · 0.90
Azure Government (includes Dynamics 365) Microsoft	Microsoft	Authorized	vendor-exact · 0.90
Esri Managed Cloud Services Advanced Plus ESRI	ESRI	Authorized	vendor-exact · 0.90
Microsoft Office 365 GCC High Microsoft	Microsoft	In Process	vendor-exact · 0.90
Office 365 Multi-Tenant & Supporting Services Microsoft	Microsoft	Authorized	vendor-exact · 0.90