CVE-2026-10759
5.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-90
Impact
Authenticated administrators can perform unintended directory operations and extract directory data via manipulated LDAP queries. An attacker needs valid administrative credentials on Portal for ArcGIS and network access to the admin interface.
Root cause
Portal for ArcGIS constructs Active Directory and LDAP search queries directly from user-supplied administrative input without proper sanitization.
Affected systems
Portal for ArcGIS (specific versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Fix & remediation
Apply the patch from the September 2026 ArcGIS security bulletin referenced by Esri. If patching must wait, restrict network access to the Portal administrative endpoints to trusted management IPs only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.