LDAP Injection Vulnerability in Portal for ArcGIS by Esri
CVE-2026-10759

5.5MEDIUM

Key Information:

Vendor

Esri

Status
Portal For Arcgis
Vendor
CVE Published:
13 October 2026

What is CVE-2026-10759?

A vulnerability in Portal for ArcGIS allows authenticated administrators to perform LDAP injection through improperly handled input in administrative functions. By crafting specific inputs, an attacker could manipulate LDAP search query construction, leading to unintended directory operations. This flaw underscores the importance of robust input validation to mitigate potential security risks.

Affected Version(s)

Portal for ArcGIS Windows 0 <= 12.2

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/ad...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.