Loading story…
Esri released emergency fixes for Portal for ArcGIS after disclosing two vulnerabilities that can let remote attackers gain unauthorized access and take over accounts in deployments on Windows, Linux, and Kubernetes. The most severe issue, CVE-2026-13019, is a missing-authentication flaw in a critical function that exposes an unprotected API and carries a CVSS 9.8 rating; CVE-2026-13020 is a weak password recovery flaw rated CVSS 8.1 that can allow an attacker to assume ownership of a user account by manipulating the recovery process. The bugs affect Portal for ArcGIS 12.1 and earlier, with the account-recovery risk especially relevant where built-in accounts are enabled.
Esri said customer environments have been targeted through ArcGIS Enterprise account recovery configurations and issued the Portal for ArcGIS Security 2026 Update 2 Patch to remediate the flaws and other vulnerabilities. The update removes recovery-question-based password resets for built-in users and requires SMTP-backed email validation for self-service recovery, while Esri also urged customers to adopt SAML or OIDC, enable MFA for administrators, and review hardening guidance. External reporting said active exploitation has been observed in targeted attacks, prompting calls for immediate patching from defenders including Germany's BSI CERT, particularly in sectors such as government, defense, utilities, and other critical infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Reporting on the two ArcGIS Portal vulnerabilities said active exploitation had been observed in targeted attacks and that Germany's BSI CERT urged organizations to patch immediately. The report described CVE-2026-13019 and CVE-2026-13020 as enabling unauthorized account takeover in affected Portal for ArcGIS deployments.
CVE-2026-13020 was disclosed as a weak password recovery mechanism in Portal for ArcGIS 12.1 and earlier that could let a remote unauthorized attacker assume ownership of a user account by manipulating the recovery process. Esri advised administrators to configure an email server with ArcGIS Enterprise to support secure self-service password recovery.
Esri PSIRT received CVE-2026-13019 on July 7, 2026. The vulnerability is a missing-authentication flaw in Portal for ArcGIS that allows a remote unauthenticated attacker to access an unprotected API in versions earlier than 12.1.
On June 23, 2026, Esri released the Portal for ArcGIS Security 2026 Update 2 Patch to remediate the account recovery issue and additional critical and high-severity vulnerabilities in Portal for ArcGIS 12.1 and earlier. The patch removed recovery-question-based resets and required SMTP-enabled email validation for self-service password recovery.
Esri said ArcGIS Enterprise account recovery configurations, particularly those using built-in accounts, were being targeted in attempts against customer environments. The company also urged customers to use centralized identity providers, enable MFA for administrators, and review hardening guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceesri.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Esri has addressed a critical SQL injection vulnerability in its ArcGIS Server product, which received a maximum CVSS score of 10.0, indicating the highest level of severity. The vulnerability affected ArcGIS Server versions 11.3, 11.4, and 11.5, as confirmed by both Esri and the Canadian Centre for Cyber Security. This flaw could allow remote attackers to exploit the system, potentially leading to unauthorized access, data exfiltration, or manipulation of geospatial data managed by organizations using ArcGIS Server. The vulnerability was disclosed publicly on October 6, 2025, and Esri promptly released a security advisory and a dedicated patch to mitigate the risk. The Canadian Cyber Centre issued an alert on October 9, 2025, urging all users and administrators of the affected ArcGIS Server versions to review the official advisories and apply the security updates without delay. The SQL injection vulnerability posed a significant threat to organizations relying on ArcGIS Server for critical mapping, spatial analysis, and geospatial data services. Attackers exploiting this flaw could have executed arbitrary SQL commands against the backend database, potentially compromising the confidentiality, integrity, and availability of sensitive geospatial information. The rapid response from Esri included the release of a Feature Services Security Patch, which is essential for closing the attack vector. Security professionals are advised to verify their ArcGIS Server deployments, ensure that the latest patches are applied, and review system logs for any signs of attempted exploitation. The incident underscores the importance of timely patch management and the need for organizations to monitor vendor advisories for critical vulnerabilities in widely used enterprise software. Esri’s advisories provided detailed guidance on the affected versions and the steps required to remediate the issue. The vulnerability’s critical rating highlights the potential for automated exploitation, making immediate action imperative for all organizations using the impacted versions. The patch not only addresses the specific SQL injection flaw but also reinforces the overall security posture of ArcGIS Server installations. Organizations are encouraged to follow best practices for web application security, including input validation and least privilege access, to further reduce the risk of similar vulnerabilities in the future. The coordinated disclosure and response demonstrate effective collaboration between the vendor and cybersecurity authorities. This incident serves as a reminder for all enterprises to maintain robust vulnerability management processes and to prioritize remediation of critical flaws in core infrastructure platforms.
Jun 29, 2026
Palo Alto Networks disclosed **CVE-2026-0300**, a critical `CWE-787` buffer overflow in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows **unauthenticated remote code execution as root** on affected **PA-Series** and **VM-Series** firewalls. The flaw carries a **CVSS v4 score of 9.3** when the portal is exposed to untrusted networks or the public internet, and Palo Alto confirmed limited in-the-wild exploitation against exposed portals. Affected versions span PAN-OS 10.2, 11.1, 11.2, and 12.1, while **Prisma Access, Cloud NGFW, and Panorama are not affected**. With patches not immediately available at disclosure, Palo Alto said fixed releases would begin rolling out between May 13 and May 28 and urged customers to restrict portal access to trusted internal zones or disable the feature entirely; the company also released a Threat Prevention Signature for PAN-OS 11.1 and later. U.S. **CISA** added the vulnerability to its **Known Exploited Vulnerabilities** catalog and ordered federal civilian agencies to remediate by the mandated deadline, while other national and regional cyber authorities issued parallel alerts. Palo Alto Unit 42 and multiple reports linked the activity to a likely state-sponsored cluster tracked as **CL-STA-1132**, which reportedly probed targets for weeks, injected shellcode into an `nginx` worker process, deleted crash artifacts and logs, enumerated Active Directory through firewall-linked service accounts, and used **EarthWorm** and **ReverseSocks5** tunnels for command and control and lateral movement. Researchers warned that thousands of internet-exposed PAN-OS instances remain reachable, making perimeter firewalls with exposed Captive Portal services high-priority compromise candidates.
Jun 29, 2026
Ivanti disclosed and patched multiple vulnerabilities in **Endpoint Manager (EPM)**, led by **`CVE-2024-29847`**, a critical unauthenticated remote code execution flaw in the **Agent Portal** service affecting versions prior to **EPM 2022 SU6** and the **2024 September update**. Ivanti rated the deserialization bug **CVSS 10.0** and said it could let remote attackers execute code without authentication; the September advisory also listed additional weaknesses including **XXE**, multiple **SQL injection** flaws that could lead to RCE, authentication issues in **Network Isolation** and **Patch Management**, API secret exposure, spoofing of isolation status, and a local privilege escalation bug in the EPM agent. Technical analysis of `CVE-2024-29847` said the vulnerable `Agentportal.exe` service exposed a **.NET Remoting** TCP endpoint with a dynamically assigned port and no transport security, allowing insecure deserialization against the `LANDesk.AgentPortal.IAgentPortal` interface. The researcher reported that exploitation remained possible even with the .NET Remoting type filter set to **Low**, adapting prior techniques to bypass remoting restrictions, gain code execution, and write an **ASP.NET web shell** into a public IIS application directory; the writeup further claimed the compromise could be escalated from the IIS application pool context to **`NT AUTHORITY\SYSTEM`** by abusing leaked token handles in the worker process.
Aug 1, 2026