CVE-2026-1446: XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier
There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are required beyond standard local user access. A local attacker can supply malicious strings that may be rendered and executed when a specific dialog within ArcGIS Pro is opened. This issue is fixed in ArcGIS Pro version 3.6.1.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1446?
CVE-2026-1446 is classified as a Cross Site Scripting vulnerability, which can allow local attackers to execute malicious code.
How do I fix CVE-2026-1446?
To fix CVE-2026-1446, upgrade to Esri ArcGIS Pro version 3.6.1 or later.
What versions of ArcGIS Pro are affected by CVE-2026-1446?
Esri ArcGIS Pro versions 3.6.0 and earlier are affected by CVE-2026-1446.
Can a remote attacker exploit CVE-2026-1446?
No, CVE-2026-1446 requires local access for an attacker to exploit the vulnerability.
What type of vulnerability is CVE-2026-1446?
CVE-2026-1446 is a Cross Site Scripting (XSS) vulnerability.