CVE-2026-10759

Full vulnerability record from the local CVENow database.

Description

A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.

Severity

MEDIUM

CVSS score

5.5 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-13 17:17:33.133000

Last modified

2026-10-26 18:17:34.737000

View original CVE JSON

{
  "id": "CVE-2026-10759",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-13T17:17:33.133",
  "lastModified": "2026-10-26T18:17:34.737",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Esri",
          "product": "Portal for ArcGIS",
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "12.1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-13T17:06:00.530560Z",
          "id": "CVE-2026-10759",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-90"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin",
      "source": "[email protected]"
    }
  ]
}