CVE-2025-57877: Reflected XSS vulnerability in Portal for ArcGIS.

Q: What is the severity of CVE-2025-57877?

CVE-2025-57877 is considered a high severity vulnerability due to its potential for arbitrary code execution in the browser.

Q: How do I fix CVE-2025-57877?

To fix CVE-2025-57877, update Esri Portal for ArcGIS to version 11.5 or later where the vulnerability has been patched.

Q: Who is affected by CVE-2025-57877?

CVE-2025-57877 affects users of Esri Portal for ArcGIS versions 11.4 and below.

Q: What types of attacks are possible with CVE-2025-57877?

CVE-2025-57877 allows remote authenticated attackers to execute arbitrary JavaScript code in victim browsers.

Q: Is authentication required to exploit CVE-2025-57877?

Yes, CVE-2025-57877 requires the attacker to have administrative access to exploit the vulnerability.

Published Sep 29, 2025

Updated

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

Affected Software

21 affected components

Esri Portal for ArcGIS<11.4

Esri Portal for ArcGIS=10.9.1

Esri Portal for ArcGIS=10.9.1-security_2025_update1

Esri Portal for ArcGIS=10.9.1-security_2025_update2

Esri Portal for ArcGIS=11.0

Esri Portal for ArcGIS=11.1

Esri Portal for ArcGIS=11.1-security_2024_update1

Esri Portal for ArcGIS=11.1-security_2024_update2

Esri Portal for ArcGIS=11.1-security_2025_update1

Esri Portal for ArcGIS=11.1-security_2025_update2

Esri Portal for ArcGIS=11.2

Esri Portal for ArcGIS=11.2-security_2024_update1

Esri Portal for ArcGIS=11.2-security_2024_update2

Esri Portal for ArcGIS=11.2-security_2025_update1

Esri Portal for ArcGIS=11.2-security_2025_update2

Esri Portal for ArcGIS=11.3

Esri Portal for ArcGIS=11.3-security_2025_update1

Esri Portal for ArcGIS=11.3-security_2025_update2

Esri Portal for ArcGIS=11.4

Esri Portal for ArcGIS=11.4-security_2025_update1

Esri Portal for ArcGIS=11.4-security_2025_update2

Remediation

Patch Available

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch

Event History

Sep 29, 2025

CVE Published

via MITRE·06:34 PM

Data Sourced

via MITRE·06:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-57877?

CVE-2025-57877 is considered a high severity vulnerability due to its potential for arbitrary code execution in the browser.

How do I fix CVE-2025-57877?

To fix CVE-2025-57877, update Esri Portal for ArcGIS to version 11.5 or later where the vulnerability has been patched.

Who is affected by CVE-2025-57877?