Weak Password Recovery Account Takeover in Esri Portal for ArcGIS

Successful exploitation allows unauthorized account takeover of affected built-in Portal for ArcGIS user accounts. An attacker who assumes control of an account may gain access to the victim's portal resources and any data or administrative capabilities associated with that account. Depending on the privileges of the compromised account, this can result in exposure of sensitive GIS and infrastructure information, unauthorized modification of portal content or settings, and broader compromise of the ArcGIS Enterprise environment. The vulnerability has also been associated with targeted exploitation activity.

If immediate patching is not possible, reduce exposure by ensuring built-in accounts do not use weak or guessable password recovery answers, avoiding common administrator account names for built-in accounts, and restricting Portal for ArcGIS access to trusted networks where feasible. Configure SMTP for ArcGIS Enterprise to support email-based validation for account recovery, prefer centralized identity providers such as SAML or OIDC instead of built-in accounts where possible, require MFA for administrator accounts, and disable unnecessary built-in privileged accounts where operationally appropriate. Administrator-initiated password resets remain available even when self-service recovery is constrained.

Apply Esri's Security 2026 Update 2 Patch for Portal for ArcGIS, which remediates this issue in affected Portal for ArcGIS 12.1 and earlier deployments. The patch changes the built-in password reset workflow by removing recovery-question-based resets and requiring SMTP-enabled email validation for remote self-service password recovery. After patching, organizations should configure an email server for ArcGIS Enterprise if self-service password recovery is needed, reset passwords for affected built-in accounts as appropriate, and review account activity and portal logs for signs of unauthorized recovery attempts or account misuse.