Critical ArcGIS Account Recovery Vulnerability Exploited in Ongoing Attack Campaign

Key Findings

• Cybercriminals are actively exploiting ArcGIS Account Recovery configurations to breach customer environments right now

• Attackers bypass hardened primary login defenses by targeting weaker account recovery mechanisms instead

• Built-in application accounts with weak security questions or common usernames are primary targets

• Organizations using centralized identity providers instead of built-in accounts are protected from this specific threat

• Esri will release a security patch within several weeks requiring SMTP configuration for remote password resets

• Immediate mitigation requires disabling Portal PSA and Server IAA accounts before a formal patch arrives

Background

Many organizations have successfully hardened their primary login defenses with multi-factor authentication over the past year. However, this security improvement has created an unintended consequence. Threat actors have simply shifted their focus to alternate access routes that remain weaker. According to Esri, the vendor behind ArcGIS, attackers have increasingly moved away from direct login attacks and toward exploiting account recovery mechanisms instead. This pivot reveals a fundamental security principle: defenders must strengthen all entry points, not just the most obvious ones.

How the Attack Works

The attackers begin by identifying active built-in accounts within a target ArcGIS deployment. They then exploit the remote password reset workflow, which often relies on security questions or knowledge-based authentication. Once they locate weak recovery answers or common administrator usernames, they submit a password reset request. If the system processes this request without secondary validation, the attacker gains full account control. This straightforward approach bypasses the multi-factor authentication protecting the primary login portal entirely.

Why This Threat Matters

A successful breach through account recovery could expose entire geospatial databases and sensitive corporate intelligence. Organizations using ArcGIS often manage critical infrastructure data, environmental resources, and location-based business information. Compromised access means attackers could steal, modify, or delete this sensitive information. The threat is particularly dangerous because many security teams focus their defensive efforts on front-door attacks while leaving back-door access mechanisms inadequately secured.

Affected Configurations

This specific threat affects any ArcGIS Enterprise deployment that has built-in accounts enabled and active. However, organizations using centralized identity management systems are safer. Esri confirms that deployments without any built-in accounts enabled inherit the security level of their organization's central identity management system. This means the threat is not universal across all ArcGIS users, but rather concentrated among those who rely on local built-in authentication.

Immediate Mitigation Steps

Administrators should not wait for the upcoming security patch to take action. First, disable the Portal PSA and Server IAA accounts immediately. Next, audit all security recovery questions to ensure they are not weak or easily guessable. Verify that service accounts do not possess administrative privileges. Additionally, implement SMTP for email validation on account recovery requests. Esri has published detailed instructions in their June 2026 ArcGIS Security Bulletin for organizations needing step-by-step guidance on these protective measures.

Long-Term Defense Strategy

The upcoming security patch will require active SMTP configuration to complete any remote password reset, adding an additional validation layer. However, the most effective long-term defense involves abandoning built-in accounts altogether. Organizations should transition to centralized identity providers that offer stronger authentication controls, audit logging, and security policy enforcement. This architectural shift removes the attack surface entirely rather than simply patching existing weaknesses.

Sources

• https://securityonline.info/arcgis-account-recovery-flaw-security-bulletin/

• https://www.linkedin.com/posts/dlross_critical-arcgis-account-recovery-targeted-activity-7474174240439713792-WhWn