{"id":"CVE-2026-10759","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-10759","generatedAt":"2026-10-28T04:35:43.010Z","title":"A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization.","description":"A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.","published":"2026-10-13T17:17:33.000Z","lastModified":"2026-10-26T18:17:35.000Z","status":"Awaiting Analysis","sourceIdentifier":"psirt@esri.com","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"},"cwe":["CWE-90"],"affected":[],"epss":{"score":0.00247,"percentile":0.15894,"date":"2026-10-27","history":[{"date":"2026-10-14","score":0.00247,"percentile":0.14798}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-13T17:17:33.000Z","detail":{"score":"5.5","severity":"MEDIUM","publishedAt":"2026-10-13T17:17:33.133Z"},"summary":"New CVE, medium severity (CVSS 5.5)."}],"references":[{"url":"https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin","source":"psirt@esri.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-10759","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}