A vulnerability in Esri Portal for ArcGIS versions prior to 12.1 introduces a weak password recovery mechanism that could lead to full account compromise.

This vulnerability (CWE-640) involves a flaw in the password recovery process. It is an unauthenticated vector that does not require user interaction, potentially allowing an attacker to reset or bypass account credentials.

The exploitation of this vulnerability presents a significant risk to organizational integrity. With a CVSS score of 8.1, the vulnerability allows an attacker to achieve high confidentiality, integrity, and availability impact, potentially leading to unauthorized access to sensitive geospatial data and administrative controls within the ArcGIS environment.

Immediate Action: Upgrade to Portal for ArcGIS version 12.1 or later as specified in the June 2026 security bulletin.

Proactive Monitoring: Audit authentication and password reset logs for unusual patterns or spikes in recovery requests originating from unrecognized IP addresses.

Compensating Controls: Implement multi-factor authentication (MFA) where possible to provide an additional layer of security that may mitigate the impact of a compromised password recovery workflow.

Public Exploit Available: false

The severity of this flaw necessitates immediate attention. Administrators should prioritize patching to version 12.1 to neutralize the risk of unauthorized account access. Failure to remediate exposes the platform to potential data exfiltration and administrative takeover.